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IT PROGRAMS AT RISK: IS IT TOO LATE TO 
SAVE $12 BILLION? 


THURSDAY, SEPTEMBER 7, 2006 

U.S. Senate, 

Subcommittee on Federal Financial Management, 

Government Information, and International Security, 

OF THE Committee on Homeland Security 
AND Governmental Affairs, 
Washington, DC. 

The Subcommittee met, pursuant to notice, at 9:34 a.m., in room 
342, Dirksen Senate Office Building, Hon. Tom Coburn, Chairman 
of the Subcommittee, presiding. 

Present: Senators Coburn, Carper, and Lautenberg. 

OPENING STATEMENT OF CHAIRMAN COBURN 

Chairman CoBURN. Good morning. The Subcommittee on Federal 
Financial Management will come to order. 

We are having a hearing today on IT projects of the Federal Gov- 
ernment. I have an opening statement, which I will not read. I will 
place it into the record and a copy will be given to each of you. 

This year, we are going to spend $64 billion on IT in the Federal 
Government. That is $15,000 per Federal employee per year. When 
we went to the private sector, we saw very few industries who 
spend that amount of money per employee on IT. There are some, 
but very few. The ratio is significant. 

A couple of things that we are looking at, this first poster^ shows 
what the budget is for IT, the watch list, and the percentage of the 
IT budget for Management Watch List projects. You can see for the 
2007 budget, it looks like only $9.9 billion. Some of the things we 
will raise today is whether or not that $9.9 billion is accurate. We 
have some major concerns that may not be accurate, although I 
would defer until we hear the actual testimony. 

The concern is spending $64 billion, first of all, are we getting 
our money’s worth for it? I have some real problems with the Ex- 
hibit 300 process, and the problems that I see with that is it seems 
to me that many of the Exhibit 300s are not written by the agen- 
cies but rather by the contractors to get the approval in the first 
place, which I think is a large conflict of interest for the agencies. 
The contractors should not be writing those. In fact, the agency 
should be writing them if, in fact, they think they need these IT 
projects. 


^The chart referred to appears in the Appendix on page 27. 
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The second poster that is up there on the Management Watch 
List 2007,2 in terms of the percentage of projects that are on there, 
from 857 projects that are proposed in 2007, 263 of these are on 
that. That doesn’t necessarily mean there is a financial problem, 
but there may be a management or execution problem that is vital 
to the country, and I think to have 31 percent of the projects, we 
are worrying about them, says a whole lot about some of our IT 
management. 

I do want to compliment 0MB on their working with us. It is 
really great to have an agency that will communicate with you, be 
fair and open and honest, and is trying to do the right things to 
right our government in terms of spending our deficits and getting 
good management tools in place, and I have been impressed with 
the quality and the openness with which our staffs and Mr. 
Portman has been available to us and his staff. 

The final poster shows performance shortfalls and how they 
break down and the number of IT projects with performance short- 
falls. ^ That number is actually on the rise, which gives me great 
concern. If you look at unclear baselines, you see what was hap- 
pening in September and December and March of 2006. If you look 
at cost and schedule variance exceeding 10 percent, you see that 
number is on the rise, where you have 25 percent of the projects, 
the cost and scheduling variance is greater than 10 percent. 

And probably even more troublesome is that the project man- 
agers for the projects are not qualified to be running the manage- 
ments, which may be one of the reasons why we are seeing the 
costs and scheduling and the unclear baselines. And then, finally, 
duplication of projects, which is also concerning. 

The key point that I want to get across with this hearing is just 
to get a better understanding of where we are on IT. Can we save 
money? 

The final point that I would make is the ability for us to look at 
and manage IT, I believe needs to be streamlined somewhat, and 
with that needs to come not cost-plus contracts, but the idea that 
if we have a clear goal in mind of what we want to accomplish, 
there, in fact, ought to be quotes out there for people to accomplish 
the goal without cost overruns, without more money, without more 
time, and they ought to sign a contract and have to perform. I 
would guarantee you, not very many businesses allow open-ended 
cost-plus contracts on IT. They get a quote, they have it competi- 
tively bid, there is a contract signed, and the requirements are met 
in the contract and if they are not met, they are enforced in a court 
of law. The idea that we have contracts that aren’t performing or 
are over cost tells us that some of our problems are in our con- 
tracting to begin with. 

So the whole goal is to look at this, to see what we can do. It 
is not to point fingers. It is not to say — I believe the efforts to get 
this under control are underway at 0MB and I want to compliment 
them on that. I want to thank the GAO, as well, for being here and 
for their work on this, because I think it is important, and it is a 
large segment. Sixty-four-billion dollars a year spent on IT is a lot 


2 The chart referred to appears in the Appendix on page 28. 
^The chart referred to appears in the Appendix on page 29. 
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of money and we ought to be getting $64 billion worth of value for 
it and we need to make sure that we continue to do that in years 
forward. 

Again, I would compliment the President’s agenda in terms of 
management agenda, what he has put in in a lot of areas. I know 
it is slow to come, but we are seeing process and I think that is 
great. But oversight is about looking at it and making sure the 
pressure is there to continue to do the same thing. 

[The prepared statement of Chairman Coburn follows:] 

PREPARED STATEMENT OF SENATOR COBURN 

Not very long ago, it would have been possible to find offices in which employees 
did not rely much on computers — today, it would be unthinkable. Information tech- 
nology has come to occupy so central a position in our work that we can barely re- 
member what we did before we all had cell phones, blackberries, laptops and email. 

The Federal Government is no exception: One of the fastest growing IT markets 
is within Federal agencies. IT projects of all kinds can speed communications, se- 
cure critical records, squeeze out inefficiencies and save time. Americans are now 
able to interact with their government in ways never before dreamed of because of 
the huge strides we’ve made in IT. 

None of this, though, has come without a huge cost. Our government has invested 
hundreds of billions of dollars in IT throughout all Federal agencies. In fiscal year 
2007 alone, the Administration has requested $64 billion to fund more than 850 IT 
projects. Money will be spent on everything from defense weapons systems to elec- 
tronic payroll and everything in between. But, with this huge investment, the gov- 
ernment also carries a huge risk. IT projects are complex and especially prone to 
schedule delays, cost overruns and, sometimes, they are obsolete before they are 
even operational. In other words, IT projects are highly susceptible to waste if we 
are not vigilant in oversight. 

Providing some of that needed oversight is why we’re here today. I want to thank 
my colleague. Senator Carper, for suggesting the need for this hearing. GAO has 
identified upwards of $12 billion in Federal IT projects with significant potential for 
waste if the right measures are not taken. As a percentage of a $64 billion IT budg- 
et, $12 billion at risk is an extremely large percentage. It means that nearly one 
in five Federal dollars that the Federal Government will spend on IT in the coming 
year may result in failure and waste. This potentially wasteful spending is an enor- 
mous problem, and one which the Federal Government cannot afford, especially 
now, but not ever. 

To put $12 billion in perspective: 

• It is about twice as much as the entire budget of the Department of Com- 
merce. 

• With an average income of $43,000 in this country, it also represents the sal- 
ary of nearly 280,000 working Americans. 

• $12 billion is the collective amount of money that more than 5,700 Americans 
with college degrees will earn in a LIFETIME. 

• Finally, to waste $12 billion would be tantamount to taking the taxes sent 
in by 1.5 million people and flushing it down the toilet. 

We must do anything and everything to steward this money so that doesn’t hap- 
pen. 

The responsibility of overseeing all Federal IT spending falls to the Office of Man- 
agement and Budget. 0MB reviews all IT projects on a regular basis to ensure that 
agencies are not spending money on wasteful projects, and keeps a close eye on the 
projects with problems, to this end, I want to congratulate the Office of Management 
and Budget for taking certain positive steps to keep track of the projects that pose 
the greatest risk of failure. It has developed two separate lists, each with a slightly 
different function: The High-Risk List and the Management Watch List. The High- 
Risk List is primarily to keep track of projects with potential performance problems, 
while the Management Watch List tracks projects planning problems. Essentially, 
one list for those projects planned well, but prone to failure in execution, and an- 
other list for those not even planned well from the start. 

Placing a project on either one of these lists is a very serious matter. A project 
is only placed on either list if it is usually risky. The disturbing reality is that, of 
the 857 Federal IT projects to be funded in 2007, 452 are currently on one or both 
of these lists. That means a staggering 53 percent of all IT projects are at serious 
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risk. The $12 billion total is obtained from adding the value of all projects on the 
Management Watch List — $9.9 billion — to the value of High-Risk List projects with 
known “performance shortfalls” — $2.2 billion. Numbers like this serve as a wake up 
call that something must be done to ensure Federal IT projects are being well man- 
aged and given proper oversight. 

Twelve billion dollars is bad enough. But I suspect that the real number is even 
higher. In June, this Subcommittee held a hearing on the Census Bureau, and dis- 
covered that the Bureau currently has a $1.8 billion contract for its technology 
needs in the 2010 Census. That contract, the Decennial Response Integration Sys- 
tem, or DRIS, is experiencing so many problems at the moment that the Census Bu- 
reau is threatening to scrap it and go back to a pen and paper census, adding a 
billion dollars or more to its costs. So imagine our surprise, to find that this contract 
does not appear on either of OMB’s two lists, the High-Risk List or the Management 
Watch List. Adding this project alone to the list would increase the amount of IT 
projects at risk of waste from $12 billion to more than $13 billion. 

Similarly, GAO has uncovered other projects worth billions of dollars that meet 
the criteria for placement on one of these two lists that do not show up either. This 
means that $12 billion may be a floor, rather than a ceiling. 

Further leading me to believe that the total dollar figure at risk is higher than 
currently known has to do with the business cases, or Exhibit 300s, submitted by 
agencies. Exhibit 300s are planning documents that agencies fill out and send to 
0MB to explain their plans for costs, schedule and other important items before a 
project ever gets funding. I am concerned that contractors responsible for carrying 
out the work may actually be the ones filling out exhibit 300s on behalf of the agen- 
cies they work for. If so, this would present an enormous conflict-of-interest, where- 
by contractors could be responsible for not only setting agency priorities, but also 
benefiting financially from them. 

Finally, my last concern gets at an issue very near to the heart of what this Sub- 
committee has tried to promote: Transparency and sunshine. Transparency means 
allowing Congress and the public to know how their hard-earned money is spent. 
At the very least, the information should be given to Congress, which is asked to 
make decisions about spending teixpayer dollars. This is especially true for the gov- 
ernment’s most at-risk IT projects. But, as of today, 0MB has kept the Management 
Watch List internally and used it for its own planning purposes. 

The Management Watch List consists of 263 projects and represents $9.9 billion 
of the government’s total $64 billion in IT spending for 2007. Each of the projects 
on this list is there because it has serious planning weaknesses. I believe that Con- 
gress has a right to know not only what these projects are, but also why we are 
funding projects that have been poorly planned. I look forward to working with 
0MB to find a way forward by which Congress can know more fully what problem 
projects it is funding while enabling 0MB to do its job as well. 

It is my hope that this hearing will provide a needed spark to try and get a better 
grasp on Federal IT spending. We cannot sit idly by and watch billions of dollars 
be put at risk year-by-year, with American citizens paying the price. Our goal 
should be to minimize that risk to the greatest degree possible and do everything 
in our power to protect the precious financial resources entrusted to us by Ameri- 
cans each year. 

I want to thank the witnesses for being here today to discuss this important issue. 

Chairman CoBURN. Senator Carper will be here in a moment. He 
is on the floor. I would like to recognize Senator Lautenberg at this 
time. 


OPENING STATEMENT OF SENATOR LAUTENBERG 

Senator Lautenberg. Thanks, Mr. Chairman. This is an espe- 
cially meaningful review because, as you noted, $64 billion being 
spent on IT, information technology, is about $25,000 per Federal 
employee. That is a huge sum of money. Federal agencies from the 
Defense Department to the Department of Veterans’ Affairs are 
funding IT projects that don’t meet clear baselines and don’t main- 
tain their cost projections, don’t stick to schedule, and don’t seem 
to have qualified project managers. 

Now, I have been in the business world and in the IT world. I 
started a company called Automatic Data Processing, ADP as it is 
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commonly known, a company that employed IT at its very earliest 
developmental stages. That company now processes one out of six 
paychecks given to employees throughout the country. We could 
never have succeeded if we had managed our technology as does 
the government. 

It seems it is very hard to get a handle around projects that we 
do in government. Mr. Chairman, I was very active on the Trans- 
portation Subcommittee in my former iteration and we started out 
with projects with the best companies, you name it, the computer 
companies, and none of them succeeded because of magnitude of 
the project was never really understood, and these things have to 
be done, in my view, modularly to make sure that you have appro- 
priate benchmarks to guide yourself by, guide your progress by, 
and not expect to be able to solve major problems in a single set- 
ting. 

So when we look at the $12 billion that could be wasted by poor 
planning, poor management and planning, just think, it could pro- 
vide health care coverage for 85 percent of the children in America. 
It could send more than two million bright young Americans to uni- 
versities. So wasting that kind of money is a disgrace. It is unac- 
ceptable. We are working hard to make our dollars go further and 
the last thing we ought to do is be throwing them away casually. 
To avoid this, we have got to hold people and government agencies 
accountable. 

Mr. Chairman, thanks again. This is consistent with your view 
of how we ought to manage government, and I agree totally, so we 
will hear from the witnesses and go on. 

Chairman COBURN. Thank you. 

Let me introduce, if I may, Karen Evans. She is the Adminis- 
trator for E-Government and Information Technology at 0MB. Pre- 
viously, she served at the Department of Justice as an Assistant 
Director for Information Services and then as Division Director for 
Information System Management. Prior to that, she was Deputy 
Director for the Applications Management Division at the Depart- 
ment of Agriculture. She has an MBA from West Virginia Univer- 
sity. 

I would also like to introduce David Powner. He is the Director 
for Information Technology Management Issues at the Government 
Accountability Office. He has been with GAO for 14 years. After 10 
years at GAO, though, Mr. Powner took a break and worked in the 
private sector for 4 years in the telecommunications industry. He 
has now been back at GAO for 4 years and brings with him a depth 
of knowledge about both private and Federal IT management. 

I would like to recognize you both. You can take the amount of 
time that you need to take in terms of your opening statements. 
Senator Carper will arrive somewhere between your opening state- 
ments and we will allow him to make a statement at that time. 

Ms. Evans. 
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TESTIMONY OF KAREN EVANS, i ADMINISTRATOR FOR ELEC- 
TRONIC GOVERNMENT AND INFORMATION TECHNOLOGY, 

U.S. OFFICE OF MANAGEMENT AND BUDGET 

Ms. Evans. Good morning, Mr. Chairman and Members of the 
Committee. My remarks today will focus on the Administration’s 
strategy and progress in planning, managing, and measuring the 
results of the Federal Government’s information technology invest- 
ments. 

The President has proposed to spend roughly $64 billion in fiscal 
year 2007 for information technology and associated support serv- 
ices to support the multiple and wide-ranging missions of the Fed- 
eral Government. When performing appropriately, these IT invest- 
ments help improve the ability of the government’s programs and 
operations to more effectively deliver services, products, and infor- 
mation to State, local, and Tribal Governments, industry, nonprofit 
organizations, and the American people. 

In particular, you have requested a discussion about two specific 
tools we use throughout the year to manage information technology 
investments, the Management Watch List and our high-risk list of 
projects. I plan to discuss our overall process for managing invest- 
ments given our tools and how 0MB executes its responsibilities 
using various methods, such as reviewing agencies’ annual budget 
submissions, engaging with agencies throughout the year on issues 
such as the E-Government scorecard of the President’s Manage- 
ment Agenda, and monitoring specific projects of interest to 0MB, 
what we call the high-risk list projects. 

0MB reviews and evaluates the business cases as part of our 
overall evaluation of an entire agency budget submission. Business 
cases are primarily planning documents and do not reflect the ac- 
tual project performance. Performance information is obtained 
through other means that I will describe later. It is important to 
note, though, that 0MB is not the only intended audience for the 
business case. The primary audiences should be and are the agency 
officials and their investment review boards. These managers 
should use the business cases to effectively manage their own IT 
portfolios and to submit to 0MB only those investment requests 
that meet the criteria specified in law, 0MB policies, and sup- 
porting the priorities of the Administration. For the fiscal year 
2008 budget cycle, agencies will be required to post on their agency 
website within 2 weeks of the release of the President’s budget 
these updated exhibits, which will reflect the final Presidential de- 
cisions. 

Business cases reflecting one or more planning weaknesses are 
placed on what we call the Management Watch List and they are 
targeted for follow-up and correction. We continue to use the Man- 
agement Watch List as one of the many tools that we use to over- 
see planning activities for the investments and to drive improved 
portfolio management. The fiscal year 2007 budget, as you have 
pointed out, is approximately $64 billion for IT and associate sup- 
port services. Included in there is 857 business cases of which the 
263 were valued at $9.9 billion not meeting this criteria for success. 


^The prepared statement of Ms. Evans appears in the Appendix on page 30. 
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As of this hearing, I am pleased to report that this year’s list has 
now been reduced to 86 investments valued at $4.5 billion. 

While over the past several years agencies have improved the 
quality of their IT project planning and justification, we have rec- 
ognized the need to continue this improvement throughout the life 
cycle into the execution phase of the IT project. This time last year, 
we issued new guidance specifically to assist the agencies in moni- 
toring and improving project planning and execution and the im- 
plementation of earned value management for their IT projects. 
The objective is to manage the risk associated with an IT invest- 
ment or project to achieve the intended outcomes. Each quarter, 
agencies evaluate and report to us on the performance of these 
high-risk projects. 

These projects are high risk, not at risk, thus the definition of 
high risk. These projects require special attention from the highest 
levels of agency management and oversight authorities, including 
0MB, agencies’ Inspectors General, and GAO. For an example, a 
project could be classified as high risk because of the exceptionally 
high cost, and even if this project is performing well, we would still 
ask and classify it as a high-risk project. 

The goal is for the oversight authorities and agency management 
to have data on how these projects are performing at least quar- 
terly to better ensure improved execution and performance. Agency 
managers and oversight authorities should know within 90 days, if 
not sooner, if a project is not performing well. The goal is to man- 
age project risk and avoid problems or catch them early enough, 
should they occur, before the taxpayers’ dollars are wasted. 

It is also important to note that this policy is designed to supple- 
ment and complement our existing oversight and agency internal 
processes, not to replace them. This policy is separate and apart 
from the Management Watch List and discusses and presents to 
oversight authorities information differing in focus, timing, and ex- 
pected results. 

0MB oversees the agencies’ activities under the President’s Man- 
agement Agenda and its associated quarterly reporting process. 
Each quarter, agencies receive a scorecard about their progress and 
status in achieving the government-wide goals. We deliberately in- 
clude a criterion for acceptable business cases to underscore it is 
at the core of an essential management practice and issue. The ac- 
ceptability of business cases is just one of the number of critical 
components agencies must satisfy to get green or yellow on the 
scorecard. If the business case criteria are not successfully met, 
agencies do not move forward, regardless of their performance on 
other elements of the scorecard. 

Additionally, our oversight of agencies’ investment requests over 
the past 2 years have identified widespread weaknesses in agen- 
cies’ abilities to meet cost, schedule, and performance goals. There- 
fore, we now emphasize earned value management as a key feature 
of the quarterly scorecard. 

And finally, the recent GAO report revealed questions about the 
validity of the agencies’ information in the Exhibit 300 submitted 
to 0MB. We are working with each of the agencies to correct these 
problems and to ensure that they do not occur in the future. 
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We do have many examples of success, two of which I included 
in my written statement, and there are more. Each year in OMB’s 
report to Congress on the implementation of the E-Government 
Act, we included one example of the success stories from the agen- 
cies. The agencies include more information in their own annual E- 
Government reports and publish them on their websites. However, 
we do need to continue improvement and build upon these suc- 
cesses to ensure that we do not waste the taxpayers’ dollars with 
duplicative investments or unsuccessful IT projects. 

I thank you for this opportunity to discuss the Administration’s 
strategy and we look forward to continue to work with the agencies 
and with Congress for new opportunities to refine our oversight 
and improve the execution of our projects. 

Chairman COBURN. Thank you, Ms. Evans. Mr. Powner. 

TESTIMONY OF DAVID A. POWNER, i DIRECTOR, INFORMATION 

TECHNOLOGY MANAGEMENT ISSUES, U.S. GOVERNMENT AC- 
COUNTABILITY OFFICE 

Mr. Powner. Dr. Coburn, Ranking Member Carper, and Senator 
Lautenberg, we appreciate the opportunity to testify on poorly 
planned and performing IT projects across the Federal Govern- 
ment. 

In fiscal year 2007, the Federal Government plans to spend near- 
ly $65 billion on information technology. Agency CIOs are account- 
able for ensuring their agency investments are appropriately se- 
lected, meaning they are tied to mission improvements and appro- 
priately overseen, meaning that progress is monitored through 
proven performance measures and corrective actions taken when 
needed. GAO’s reports and others have highlighted that there is 
much room for improvement in these areas. Given this, OMB’s 
statutory responsibility, to establish processes to analyze, track, 
and evaluate the risks and results of major capital IT investments, 
is critical. 

To its credit, 0MB has established several processes and criteria 
to improve the management of Federal IT projects, including the 
E-Government scorecard associated with the President’s Manage- 
ment Agenda, the Management Watch List that identifies poorly- 
planned projects, and high-risk projects that identify poorly per- 
forming projects. 

This morning, I will summarize three key points. First, agencies 
and 0MB annually identify hundreds of IT projects representing 
billions of dollars that are poorly planned or performing. Second, 
our work has shown that the number of troubled projects is likely 
even higher. And third, opportunities exist to oversee these projects 
better. 

First, over 300 projects totaling more than $12 billion in esti- 
mated IT expenditures have been identified on OMB’s Management 
Watch List or as a high-risk project with performance issues. Spe- 
cifically, in the President’s budget, 0MB reported that 263 projects 
representing about $10 billion is on the Management Watch List. 
Today, 0MB is reporting that this number is now 86 projects total- 
ing $4.5 billion, still significant. 


^The prepared statement of Mr. Powner appears in the Appendix on page 36. 
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In addition, agencies reported that 79 high-risk projects collec- 
tively totaling more than $2 billion had performance shortfalls. 
Highlighting these projects with shortfalls creates tremendous op- 
portunities to correct deficiencies in these investments that com- 
prise a significant portion of the Federal IT budget. 

Our work has shown that the number of projects is likely even 
higher. 0MB derives projects on its Management Watch List based 
on a detailed review of IT budget justifications, called Exhibit 300s. 
Our evaluation of Exhibit 300s showed that the information re- 
ported in them is not always accurate or reliable. This is not sur- 
prising, since there is pressure to overstate budget justifications so 
that investments can make the selection cut and to keep them off 
of OMB’s oversight radar. Ensuring reliability of information in the 
Exhibit 300s is essential for many reasons, including an accurate 
Management Watch List. 

Eor the high-risk projects, we found that agencies do not always 
consistently apply OMB’s criteria for identifying these projects. Eor 
example, we found projects that we have reported on and testified 
on that have clearly met OMB’s criteria that were not listed. These 
included a key census system and environmental satellite acquisi- 
tions that are both laden with risks. 

In addition, the charts in my written statement that lists the 
number of poorly-performing projects by agencies raises many 
questions. Eor instance, how can DOD only have five performing 
projects when they comprise $30 billion of the 64? In addition, 
NASA reported no projects. 

In addition to improving how these projects are identified, im- 
provements are also needed in how these deficiencies are followed 
up on, tracked to resolution, and reported. 0MB does not aggregate 
either list. We have never seen the complete list of Management 
Watch List projects, as 0MB keeps this information in-house. In 
addition, we have found the processes of following up on the watch 
list projects to be ad hoc and are concerned that this may leave un- 
attended weak projects consuming significant budget dollars. Con- 
trary, the high-risk projects are available for IGs and GAO and 
their follow-up is transparent through a quarterly reporting proc- 
ess. 

To take full advantage of both lists, we recommended that 0MB 
aggregate each list so that government-wide analysis can be per- 
formed, resolution of deficiencies can be tracked, and the list of 
specific projects can be shared with the Congress to assist in the 
Administration’s oversight. Until this occurs, 0MB is missing an 
opportunity to seek assistance in assuring that agencies address 
project weaknesses. 

In summary, 0MB should be commended for its many efforts to 
identify projects at risk and to raise the bar on CIO accountability. 
But, Mr. Chairman, this bar has a ways to go. First, OMB’s over- 
sight starts with accurate data being reported to them. Data used 
to identify both watch list and high-risk projects needs to be im- 
proved and 0MB needs to round out its oversight of these projects. 
Until this is done, not all problem projects will be identified, nor 
do we have assurance that follow-up on identified problems is 
enough to keep billions of dollars from being wasted. 
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This concludes my statement. I would be pleased to respond to 
questions at this time. 

Chairman COBURN. Thank you, Mr. Powner. 

Welcome, Senator Carper. Let me give due credit to Senator Car- 
per. The idea behind this hearing is his and his interest in making 
sure we are efficient. I am pleased that we are able to have this 
hearing. I also would say that this won’t be the only hearing on IT 
that this Subcommittee will have. We are going to watch this. 

Senator Carper, you are recognized for an opening statement. 

OPENING STATEMENT OF SENATOR CARPER 

Senator Carper. Thanks so much. I apologize to our witnesses 
for not arriving earlier. As I think the Chairman knows, we begin 
every day in the U.S. Senate with an opening prayer and often- 
times the prayer is given by the Senate Chaplain, Barry Black. Oc- 
casionally, we have a guest who presents the opening prayer and 
today that person was from Delaware, the leader of our Greek- 
American community, and I wanted to be there to welcome him, so 
I missed, unfortunately, all of your statement, Ms. Evans, and part 
of yours, Mr. Powner. 

I am grateful to the Chairman for agreeing to schedule the hear- 
ing and I am thankful to my own staff and to our majority staff 
for working with us to make it a good one. 

There is a lot of money involved in these projects. As the Chair- 
man noted, no one is more committed in the Senate than he is to 
finding ways to bring down our budget deficit and reestablish some 
fiscal sanity around here, and we can’t ignore the potential savings 
that we can accrue by putting in place solid, sound IT projects. 
That is good to the extent that there are those that are running 
off the track and we can identify those and try to get them back 
on track. That is critically important, as well. 

I remember from my own experience in my old job, my last job 
as governor, the money that we spent and money that we invested 
in IT projects of all kinds. Some of them were able to enable us to 
save a lot of money, and frankly, some of them cost a bundle and 
didn’t, at the end of the day, we didn’t have as much to show for 
them that we wanted to. They are not easy to do well, and frankly, 
the oversight in some cases, at least in our case, wasn’t what I 
would have liked. 

I am grateful to our friends from GAO for trying to help us in 
our oversight missions to make sure that to the extent that we can, 
we play the appropriate watchdog role, not just being critical but 
being constructive, asking the right questions as we go forward. 

I have a statement that I would like to enter for the record, Mr. 
Chairman. I am grateful that we are here. This is good stuff. 
Thank you. 

Chairman COBURN. Without objection, your statement as well as 
mine will be entered. 

[The prepared statement of Senator Carper follows:] 

PREPARED STATEMENT OF SENATOR CARPER 

I want to thank Chairman Coburn for holding today’s hearing to focus on how the 
0MB will ensure the success of potentially $12 billion — as of this hearing, $7 billion- 
at-risk information technology projects. As our witnesses will testify to, the Presi- 
dent has proposed to spend nearly $64 billion in FY 2007 for information tech- 
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nology. Without the needed investments in information technology, our government 
could not conduct its everyday business. As we all know, investment in information 
technology is not a one stop deal. Implementing and maintaining information tech- 
nology involves detailed planning — with clear costs, project schedules, and perform- 
ance goals. Within Federal agencies. Chief Information Officers and project man- 
agers are among the many that have the responsibility to ensure that information 
technology projects are implemented in the most efficient manner. We in this 
room — our Subcommittee, the Office of Management and Budget, and the GAO — 
also have the responsibility to conduct oversight on Federal information technology 
investments. It’s unfortunate that not all information technology projects are imple- 
mented in the most efficient manner. 

As the 0MB will testify to, there are currently 226 information technology 
projects classified as “high-risk.” The 0MB also has 86 information technology 
projects listed on their “Management Watch List.” Information technology projects 
that are the most at-risk of planning and performance shortfalls total nearly $7 bil- 
lion in Federal funds. What we will hear today is that $7 billion worth of informa- 
tion technology projects is in serious risk of being wasted unless: 

• The 0MB improves its oversight of at-risk information technology projects, 
and 

• Agenceis improve their reporting on all information technology projects. 

Due to problems with the OMB’s classification of high-risk projects and projects 
on the Management Watch List, I believe the 0MB cannot possibly be carrying out 
adequate oversight of information technology projects. Not only does the 0MB not 
keep running-aggregate lists of the Management Watch List and high-risk projects, 
the 0MB does not have consistent processes for following-up on at-risk projects. 

In my opinion, one of the most concerning problems, which the GAO will testify 
to, is that agencies often inadequately report information on their information tech- 
nology projects. Agencies are required to justify resource requests for major informa- 
tion technology projects on forms that the 0MB calls Exhibit 300s. Unfortunately, 
information on these forms is often inadequate. Agencies tend to leave out necessary 
documentation and include unreliable cost estimates. Therefore, according to the 
GAO, the 0MB is depending on unreliable information when monitoring the man- 
agement of major information technology projects and making critical funding deci- 
sions. Since the 0MB derives its information from Exhibit 300s when placing 
projects on its Management Watch List, I believe that the number of projects on 
that list (approximately 86) is likely to be understated. 

Until we fix these problems, the Federal Government risks losing billions of dol- 
lars from the shortfalls of the most at-risk information technology projects. Person- 
ally, I believe that both the 0MB and Federal agencies can do better and we must. 
I look forward to hearing suggestions from our witnesses on how we can improve 
oversight of the most at-risk information technology projects. 

Thanks you. 

Chairman COBURN. I am going to start off our questioning. I 
want to try to get an understanding of process a little bit. We have 
an Exhibit 300. This is a justification for a project, is that correct? 

Ms. Evans. It is a justification for an investment. 

Chairman COBURN. For an investment in IT 

Ms. Evans. Yes, sir. 

Chairman COBURN [continuing]. To save money? 

Ms. Evans. Well, not necessarily to save money, as well. It is a 
justification in order to meet a business need or requirement. 

Chairman COBURN. All right. And that is approved by an agency 
Secretary and that is approved by a management review board, is 
that correct? 

Ms. Evans. Yes, sir. Within an agency, there is an investment 
review board and then the CIO is to manage the investment review 
process, and it is included in the project and then gets submitted 
by the Secretary. 

Chairman CoBURN. So that happens. So how come we have a 
third of them that are poorly planned? 
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Ms. Evans. That is actually a really good question and why we 
have been working on it since I have been in this job, of going 
through and making sure that we have the underlying manage- 
ment practices in place, that we really are reviewing the invest- 
ments, that you really are looking at those to ensure that there is 
alignment between what you are trying to do in a program and 
how the IT investment will support that program, either through 
efficiencies or to get the outcome to support a service. 

Chairman COBURN. What I am trying to figure out is the man- 
agement review board, if we have nearly a third of them poorly 
planned, somebody isn’t doing their job right. 

Ms. Evans. Yes, sir. 

Chairman CoBURN. So where does that lie? Does that lie at the 
CIO level, the management review board, where does that lie? If 
the whole purpose for the Exhibit 300 is to give a justification for 
an investment for a project or an advancement or greater ability 
for the government to function in some way or measure something 
or defend us and we have that laid out and that gets approved and 
yet a third of them are poorly planned, I thought that was the pur- 
pose for the Exhibit 300, is to make sure they are planned prop- 
erly. 

Ms. Evans. Yes, sir, and the way that the process is set up and 
the way that we hold the agencies accountable is through the score- 
card process. So the Secretary is ultimately held accountable for 
making the decisions of what those IT investments should go for- 
ward to support the Administration’s priorities and that agency’s 
mission goals to support the Administration’s priorities. 

Chairman CoBURN. So is it possible that the Exhibit 300s aren’t 
accurate when they come through? 

Ms. Evans. It is possible that the Exhibit 300s, based on the skill 
levels of the people evaluating them at the agency and the CIO 
who is explaining how this works, may need improvement. And so 
I think that is evident when you look at the overall performance 
and how we have ranked the agencies on scorecard, because if all 
agencies were performing well, then we would have all agencies 
showing a green progress and green status. We don’t have that. 

As you can see on the scorecard, if you have had an opportunity 
to look at it, which I am sure you have, you can see that we have 
agencies that are very red and we have agencies that are having 
mixed results, a yellow score, based on what they are doing, and 
then agencies who are green. There are a few agencies that are 
green, and it varies back and forth based on where we are in the 
year and the products that we are evaluating from our oversight 
role during the quarterly scorecard. 

So I agree with you there are problems and we have identified 
what they are and we work with the agencies to strengthen where 
those weaknesses are within the agencies. 

Chairman COBURN. When you look at these projects, do you ever 
look at the projects by vendor? 

Ms. Evans. No. 

Chairman CoBURN. Well, let me suggest that you do that be- 
cause, in fact, if we have a large number of underperforming or 
poorly planned or high-risk but we are not looking at it by vendor, 
we may, in fact, see a trend by two or three vendors out of the 10 
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or 20 or 50 that are used that says these are constantly poor per- 
forming, or these are constantly over cost or behind schedule. I 
think that one of the analyses that 0MB ought to do is look at it 
by vendor and see if there is a pattern of poor performance. 

Mr. Powner talked about inaccurate reporting — what is the con- 
sequence for an agency for inaccurately reporting? 

Ms. Evans. In the fact that we identify that there are weak- 
nesses associated with a business case when it comes in. I am 
going to say we make an assumption that people are not delib- 
erately reporting erroneous data, that what we need to do from an 
0MB perspective is identify what appears to be the job or what is 
the issue within that agency. Is it just within that particular in- 
vestment or is it a systemic problem throughout the agency? 

For example, one thing that we have noticed across the board, 
and you have highlighted it in your charts, is the ability for agen- 
cies to put qualified project managers in charge of individual 
projects as they go forward. We have that as a systemic problem 
across the government, not just within an agency. 

So if that is a weakness that is identified, what we do, what I 
do through the CIO Council, is we come up with an overall plan, 
which we have, to work with the agencies to strengthen project 
managers, also come up with a common way that agencies can 
evaluate the qualifications of the people who they are putting in 
charge of projects so that we have a consistent measure across the 
board, and then once that is done, what we have worked now with 
the agencies over the past year is each agency has a human capital 
plan for the weaknesses of their workforce and they have specific 
milestones that are now being measured through the Human Cap- 
ital Initiative on the President’s Management Agenda for them to 
either hire, recruit, or train and close those gaps so that, first and 
foremost, first defense there, is being met and that the agencies 
can then improve that area to at least move forward in that par- 
ticular piece dealing with success. 

As far as if they overall have a systemic problem and we cannot 
remediate what we see as a weakness before the fiscal year starts, 
then 0MB does take action such as using the tools that we have 
available, like Category B apportionments, and so then that puts 
more restrictions on the agencies to produce results instead of get- 
ting the money, them being able to do what they want to do and 
then us not having proper oversight. 

Chairman COBURN. I don’t want to question anybody’s motiva- 
tion, but one of the tools of management is consequences of not 
stepping up to the line. So whether somebody inadvertently or in- 
tentionally is inaccurate in their reporting, what I want to see de- 
veloped, and I think is a correct management technique, is there 
ought to be a consequence and there ought to be a measurement 
goal of whether or not they are performing accurately in terms of 
reporting accurately. 

Ms. Evans. I can tell you that, especially when I was still at the 
agency at the Department of Energy, the goals that we have in the 
E-Government scorecard are directly reflected and were directly 
reflected in my performance plan, which then meant that my own 
individual performance plan as an SES within the government was 
that I had to meet those marks and there were consequences. If I 
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did not achieve that within my own agency of what those require- 
ments were, it was reflected in my own performance, which then 
reflected my ability to get a raise or a bonus or those types of ac- 
tivities. That alignment is now there in many of the CIOs’ perform- 
ance plans and they are now getting greater alignment within their 
own agencies so that you can see how people’s performance is now 
dependent on each other. 

We have also done that internally within my own staff. So some 
of the weaknesses and some of the repeatable processes that we are 
talking about that we need to improve on ourselves, we have now — 
through the President’s Management Agenda, we are a beta site. 
So my own performance plan is public so that you can see what the 
goals are, but my staffs performance plans now align to those goals 
so that they are now vested in the agency’s success, as well. So 
there is an individual consequence back on all of us who are re- 
sponsible for ensuring the management of these initiatives. 

Chairman CoBURN. But the project still gets funded. 

Ms. Evans. Sometimes the projects need to be funded, and that 
is why we put them on the Management Watch List. For example, 
when I first came into this job, one of the investments that were 
on there was TRICARE For Life. That was on the Management 
Watch List. They needed to do certain investments in order to up- 
grade and be able to improve health care information. You are not 
going to not fund things to support TRICARE For Life, but what 
you are going to do is then put additional oversight and manage- 
ment into that to ensure that — because this is now an area that we 
need that is high risk, so we need to continue to watch that to 
make sure that DOD had the right practices in place so that they 
could achieve the outcome knowing that there was a risk associated 
with it. 

Chairman COBURN. I want to go back to something Mr. Powner 
said, and it concerns me because the Defense Department has $30 
billion out of the $65 billion in IT. The question I have is either 
their reporting is inaccurate — as a matter of fact, I know their re- 
porting is inaccurate because DTS, the Defense Travel System, 
isn’t on anybody’s list and it is a mess and it has been a mess from 
the time it started in terms of cost overruns and delays and every- 
thing else. So there has to be inaccurate reporting. This is going 
back to the point that my worry is that we are underestimating 
what the risk is, and I think GAO has testified to that. How is it 
that Defense can say, and I don’t know where I have it, but I have 
the list of all the projects 

Ms. Evans. Right. 

Chairman COBURN [continuing]. And they have very few on the 
high-risk list and very few on the Management Watch List. How 
can that be? 

Ms. Evans. And I would put the responsibility back on myself as 
far as clarity of the instructions and then consistency across the 
board about how we need to work with the agencies to be able to 
do that. So Defense is a good example. So when we are looking at 
this — this is a new policy that we put in place — there is a distinc- 
tion between what is on the Management Watch List and the high- 
risk project list. 

Chairman CoBURN. Yes, I understand the difference. 
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Ms. Evans. But I would say that we need to bring better clarity 
to the instructions on what should be on a high-risk project. For 
example, we have all the 24 E-Government initiatives on the high- 
risk project list that we monitor through another mechanism. That 
is not included because there isn’t a direct Exhibit 300 to map a 
lot of those to within each of the agencies. 

Chairman COBURN. And why is that? 

Ms. Evans. Because of the way that we allow certain flexibility 
of how agencies would categorize a major capital investment, and 
so that is why we make a distinction between an actual project 

Chairman COBURN. And the investment 

Chairman COBURN [continuing]. And the capital investment. For 
example, our policy says that all office automation and infrastruc- 
ture types of investments need to be on one business case. So that 
would be things like telecommunications, office automation, any of 
those types of things, BlackBerrys, e-mail. You could have several 
major projects included in that one investment, like what we are 
currently doing now, the upgrade to IPB6. That is a project, but 
that would only have one capital investment. If you are upgrading 
your telecommunications to use new technology like voice-over IP 
and consolidate phone systems, that is only going to show up in one 
business case, one Exhibit 300, but that is a separate project. So 
that one particular investment could have anywhere, at a min- 
imum, like five major projects underway. So that is why we have 
distinguished between the two of them. 

A lot of the E-Government initiatives, the dollar threshold is 
really low because the total budget across the board when we are 
collecting that, it averages about $190 million all the way across 
the board for all agencies doing all of their parts within 25 initia- 
tives and six lines of business. But it is the complexity of depend- 
ing now on interagencies to meet their part and the project plan- 
ning and the major milestones make that high-risk, because if one 
person misses a milestone, the ripple effect is huge. So that is why 
we distinguish those. 

We have to go back to the agencies, giving the example that you 
just gave, like DOD, and clarifying further to them how they can 
use these tools and not necessarily drive reporting underground so 
that they get on our list and then we are looking at them, but en- 
couraging them to use these tools so that they can really manage 
it within their agencies to achieve the results. 

Chairman COBURN. My time is up. Senator Carper. 

Senator Carper. Thanks, Mr. Chairman. 

In State Government, as in Federal Government, we use infor- 
mation technology in similar initiatives to provide better service. 
We use them to save money. We use them to, in many cases, im- 
prove the performance but also the job satisfaction of those that are 
working, whether it is in State or the Federal Government. I like 
to say that everything I do, everything that my team, my staff and 
I do, we could do better, and I think the same is probably true in 
every agency with whom you or each of you work. 

I want to start off with just a real basic question so I understand 
it. Now, the Chairman has delved into this, and I am sure, Ms. 
Evans, you spoke to it in your testimony. But I understood pretty 
well in State Government how we identify initiatives to which we 
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wanted to bring information technology to bear. Just explain in a 
very basic way, how agencies identify their own IT projects, the 
screening process that they go through to have those funded, and 
then, if you will, the process by which we oversee, or 0MB or some- 
one oversees those projects to make sure that we are getting our 
money’s worth, projects end up on the watch list. 

Ms. Evans. What an agency should do, and when I was at an 
agency myself, the way that we would do this based on the policies 
that are existing within 0MB and the laws, what you are supposed 
to do is take a look at what are the agency’s business needs, and 
basic things like utilities, telecommunications, office automation, 
those types of activities, you are supposed to go through, look at 
what is the cost to operate those, if you are going to upgrade those, 
it is a major system investment that you would then take to what 
is called an investment review board. Some agencies will have 
them divided into two areas, a technical review board as well as 
an executive review board. 

So the first threshold would be the technical review board would 
say, OK, this meets all our requirements. This has a good return 
on investment. It appears that it is going to meet our agency needs. 
So it can meet that first threshold of review. 

When it goes to the second level of review, which is an executive 
review board, they have to look at that across the board of what 
dollars do we have available? What are we trying to accomplish? 
What is the mission of the agency? Does this support mission out- 
comes? If we invest this dollar, will we achieve X, Y, and Z? And 
the business case is supposed to be able to articulate that in a way 
and summarize it in a way that senior executives can realize if I 
invest this one dollar, I am going to achieve X results for my mis- 
sion. That is how you are supposed to do it. 

And then at that point, you then tie it, and we ask it to be very 
specifically tied to a program or to a business outcome. Are there 
performance measures? How will you know you will be successful? 
Is it just total efficiency because I am going to reduce cycle time? 
Those types of activities. That all is summarized in what we are 
calling the business case, the Exhibit 300. 

Senator Carper. Back up. Say that last sentence again, please. 

Ms. Evans. Sure. They are supposed to review these investments 
to ensure that they are tied to a business area, that they are either 
tied to an efficiency measure, like they are going to reduce cycle 
time within an agency — I am not going to mail things out anymore, 
those types of things, or actual program performance, that they 
have a measure that they can show that if I invest a dollar, this 
is the outcome that I should get. And that is what they are sup- 
posed to include and justify within what we call an Exhibit 300. 

Then what the CIO does all throughout this process is advise, 
make sure that it is aligned with everything that they are doing 
IT-wise within the agency, information-wise, make sure there are 
no duplications for the cost savings, how you can maximize those 
things, and then they send them over included in the overall budg- 
et because these are the investments that are going to enable pro- 
gram results. And then we 

Senator Carper. Let me interrupt. 

Ms. Evans. Sure. 
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Senator Carper. When would that he taking place during the 
year, right about now? 

Ms. Evans. September. Yes, sir. We get them as part of the reg- 
ular budget submission, and so they are submitted concurrently 
with the overall budget and then what my area does is review and 
analyze those across the board to make sure that they are sup- 
porting the program outcomes. So there are very specific questions 
that we will ask, like we will ask, are you supporting a program 
that has been PART-ed? What are the measures associated with 
that? 

And so we look at those and we analyze them across the board. 
There are several criteria. There are several areas, acquisition 
strategy, project management, all those things. We look at them 
through our lens. So an agency may feel that they have done every- 
thing to the extent possible to mitigate risk, that they have a quali- 
fied project manager, that they have certified that project manager, 
they have good performance measures, but then we evaluate it and 
look at it and that is how they end up on the Management Watch 
List. From that planning document, we will say there appears to 
be weaknesses in the performance. 

But we also use other information at that point, because that is 
the same time that we get the annual cyber security reports com- 
ing in from the IGs and the CIOs. So if there is an overall problem 
in an agency, their ability to manage and secure data that they are 
collecting, we also use that information because there is a piece 
within the business case that talks about cyber security. 

So there are several tools that we use when we evaluate it and 
then determine that planning project, that particular effort should 
be on a Management Watch List, and then we integrate our proc- 
esses into the internal 0MB processes that then the Director re- 
views and makes recommendations to the President about what 
should be included in the investments going forward. 

Senator Carper. Maybe for no one else in the room, but for me, 
that was helpful. Thank you. 

Mr. Powner, let me turn to you, if I could. The title of your testi- 
mony, full testimony, is “Information Technology: Improvements 
Needed to More Accurately Identify and Better Oversee Risky 
Projects Totaling Billions of Dollars.” Sort of reflecting back on 
what Ms. Evans has just said and thinking of what you are trying 
to do in your testimony, looking at the process that she outlined, 
what are the strengths and weaknesses of that process? 

Mr. Powner. First of all, if we start with the Federal agencies, 
and back to Dr. Coburn, your question, too, where you look at those 
processes that are in place associated with these management re- 
view boards, our reviews of individual agencies and government- 
wide looking at basic processes that are in place with these invest- 
ment review boards, do they select the investments appropriately? 
And what this is all about is racking and stacking of business 
cases. You rack and stack them. You put them in priority order and 
you say, here is where the budget runs out and everyone else 
doesn’t get funding and these projects do. Now, there are a few nu- 
ances to that because of things that are called for in law and that 
type of thing 

Senator Carper. Because of things that are called what? 
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Mr. PowNER. There are a few nuances that because of require- 
ments in law for certain projects need to he funded and that type 
of thing, but overall, that is how it should work, just the way Ms. 
Evans described it. 

If you look at those processes at the agency level, we found weak- 
nesses across the board. Sometimes the investment review boards 
don’t comprise the right individuals. You can start there. The CIO 
should be driving it. You ought to have the business owners of 
these systems on the boards. We found investment boards that 
don’t have the appropriate makeup, they don’t have the appro- 
priate processes, and I think agencies are improving over time. I 
think 0MB is doing a lot to improve those processes. Our reviews 
highlight some of these things. 

This goes back to requirements called for in the Clinger-Cohen 
Act back in 1996, so this isn’t new and these processes aren’t new, 
but there are weaknesses there. So first of all, you have those 
weaknesses at the agency level. 

And then when you look at, if you think about the racking and 
stacking of these Exhibit 300s, of the business cases, there is pres- 
sure to game those business cases, to overstate. What our review 
showed, we looked at 30 of these in great detail at a number of 
agencies and they were inaccurate, unreliable, and not supported 
by documentation in a number of areas. So if you look at that, 
what do we do about it? 

I think 0MB issued some new instructions where agencies are 
going to publish on their websites these business cases. That will 
help. That is a step in the right direction. Another step in the right 
direction is within the agencies, there are controls that can be put 
in place. In the private sector, the same thing happened. Eolks 
game their business cases because they want to secure funding. 
What did we do? We used internal audit to review business cases. 
Why not use IGs to review a handful of business cases that would 
at least put those project owners on their toes that it is going to 
get looked at? You don’t know which ones are going to get re- 
viewed, but you could look at a handful. There are controls that 
you could put in place to improve this process. 

Senator Carper. My time is about to expire here on this round. 
Mr. Chairman, could I ask Ms. Evans just to respond briefly to the 
recommendations that Mr. Powner made right at the end of his 
comments? 

Ms. Evans. Actually, I wrote the recommendation down because 
that is a great idea. We work a lot with 

Senator Carper. Just restate the recommendation and then re- 
spond to it. 

Ms. Evans. The recommendation is to use the Inspector Generals 
within the agencies to go and do a random check of the business 
cases to ensure quality. I think it is a wonderful idea. We work 
with the IG community often. The IG community is doing certain 
things for us right now. They do it on the cyber security aspect for 
us so that we get that independent review and I am willing to take 
that recommendation back to the IGs and ask them specifically, 
would they be willing to take that on. 

They have taken on several things for us, like validating savings 
where agencies have estimated what their cost savings would be. 
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and validate that type of methodology. The high-risk policy 
projects, we also ask for independent validation, and that is where 
we did open up everything for IGs and GAO to request all that doc- 
umentation, as well. And I do think that several of them, I know 
GAO has taken us up on that and they are reviewing that informa- 
tion that the agencies should have available and randomly look at 
to support whether it is really reliable data. 

Senator Carper. Let me, first of all, thank you for the sugges- 
tion, Mr. Powner, and for the spirit that you responded to it, Ms. 
Evans. I think it would be interesting or be welcomed if you would 
let us know what kind of progress is made on this front. Thank 
you. 

Chairman CoBURN. Ms. Evans, are Exhibit 300s ever rejected? 

Ms. Evans. Yes, they are, but 

Chairman COBURN. What is the frequency of that? 

Ms. Evans. From our perspective, it is very few because of the 
checks and balances that we have put in place, because what we 
really are doing at that point is that we want the agencies to do 
that due diligence going forward, so we really should not get failing 
business cases. 

Chairman CoBURN. But let us go back to the earlier question. 
You get 30 percent of them, poor planning that we have now 

Ms. Evans. Yes. 

Chairman COBURN [continuing]. And we haven’t rejected the Ex- 
hibit 300s. Something is wrong in between there. 

Ms. Evans. Well, because those investments that do come for- 
ward that we then release on the Management Watch List are in- 
vestments that are clearly aligned with the President’s priorities 
that we feel that we do need to go forward with, but do extra due 
diligence on whatever the gaps are that we have identified. But do 
we outright say no to something? Yes, we have done that because 
it is not either aligned with the President’s priorities or agencies 
will come back based on the guidance that we do through our budg- 
et process and will withdraw them or cancel them. 

Chairman CoBURN. Based on what Mr. Powner said about the 
boards not being constituted properly, some suggestion that some 
of the firms are actually writing the Exhibit 300s rather than the 
agencies, are you aware that happens? 

Ms. Evans. Sure. Absolutely. That is why 

Chairman CoBURN. Do you not see that as a conflict of interest? 

Ms. Evans. What I also see is that people view, and this will 
support Mr. Powner’s comments, that the Exhibit 300 is like the 
test. This is the test. If I turn in a good term paper, I am going 
to become fully funded. So we recognize that maybe we were driv- 
ing certain behavior so that an industry is springing up that is 
writing business cases. We run analysis, for example, on a port- 
folio. This is because we get it all electronic. I ran an analysis this 
past year. We did an analysis to see exactly how many words 
changed in a business case because it is electronic. So we can run 
it through and see how many words actually changed. So knowing 
where the investments are, for example, if they are steady state, 
then we should see more things happening later in the life cycle 
on the latter part of the business case. If they are in the first part. 
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then you would see big changes in what they have completed in 
their acquisition strategy and where they are now in execution. 

Needless to say, what was happening was we had very few busi- 
ness cases that there were absolutely no changes to, but there are 
sections where, for example, in security where nothing is changed 
but we knew they had a problem. So we know that there is evi- 
dence of people just trying, well, this passed last year so I will just 
resubmit it again this year. 

Chairman CoBURN. So how do we fix that? How do we incen- 
tivize behavior that is based on accuracy and better outcome? 

Ms. Evans. Well, the way that we did it, and we would welcome 
any comments or additional suggestions that you would have is 
that is why we released and really focused on execution, because 
it is one thing to talk about what you are going to do, but it is an- 
other thing to actually be able to deliver results. 

And so through our implementation and oversight of what the 
agencies are doing through earned-value management, which is 
really you are taking actual against planned, so there are 32 dif- 
ferent criteria in that 

Chairman COBURN. So it is measurement metrics? 

Ms. Evans [continuing]. And there is measurement metrics in 
that and it is very sensitive. And so when you start getting those 
reports and you are looking at those, and I personally read those. 
An agency does not get the checkmark to move to green that they 
actually are managing 10 percent of cost schedule and performance 
until we — and we physically go to the agency and we discuss with 
the agency managers, because we know the same weakness that 
Mr. Powner has brought up. Who is actually managing this? Are 
you just producing reports because 0MB has asked for reports or 
are you really using this data to make management decisions? 

And so it is one thing to get a really good planning document. 
It is almost like you take a driver’s test. In West Virginia, you have 
to take a driver’s test, but then you actually have to drive before 
they give you the license and it is a 6 months’ difference. It is the 
same type of logic that we apply here. You can get through the first 
hurdle because you wrote a good term paper, but you have to now 
apply that knowledge that you said you have and produce results. 

Chairman CoBURN. Good analogy. The problem I have with the 
way we are doing it is we are looking backwards rather than 
incentivizing behavior going forward. I would love for you all to 
think about, and maybe Mr. Powner think about, how do we set 
the system a little differently where we incentivize better behavior 
rather than have to look back? What you are doing is auditing, 
right? 

Ms. Evans. Yes. 

Chairman CoBURN. The fact that there is an audit and an audit 
can be gamed and then you are using the final, where is the per- 
formance. But how do we get it to where we have to do less audit- 
ing and less control after the fact and incentivize better in the be- 
ginning? I don’t expect you to answer that, but I think that is 
where we want to go with this, because if we have management re- 
view boards that are not constituted properly, how do we 
incentivize that to change? In other words, not after the fact that 
we come back and look at it 
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Ms. Evans. Right. 

Chairman COBURN [continuing]. But how do we get it right the 
first time? From my business experience, it just wasn’t acceptable. 
What we are seeing in this is things that would never be accept- 
able in a personally-run business or like what Senator Lautenberg 
had. It just wouldn’t be acceptable, the degree of what we are see- 
ing, and I know it is tough to manage that. 

Again, let me go back to the Exhibit 300. The whole purpose for 
that is to put forward a plan that is based accurately, that will be 
a proper investment, whether it be through cost savings or accom- 
plishing a goal. How do we make that tool really be what it should 
be? Let me address that to you, Mr. Powner. How do we make sure 
that every Exhibit 300 is right, is accurate, to the best of the abil- 
ity it can be, with no question about motives, so that we can make 
a good judgment on it? Everything after that, once that goes 
through, it is all retrospective looking. 

If you look at the Defense Travel System, or, for example, an- 
other one that is not on the high-risk list is the Census Bureau. 
I can’t figure out how that isn’t on the high-risk list. That system 
is either gamed — I will reserve my comment. There is no way it 
should not be on the high-risk list. 

Ms. Evans. Right. 

Chairman CoBURN. Senator Carper and I have sent a letter to 
GAO today asking some very specific questions about the Decennial 
Response Integration System, because I think it is a disaster right 
now. The fact that it is not on there tells us we have got a problem 
with the list. 

Ms. Evans. Yes. 

Chairman CoBURN. How do we do that, Mr. Powner? How do we 
make it more effective prospectively rather than have to have the 
threat of a retrospective look? 

Mr. Powner. A couple of comments. First of all, the Exhibit 300, 
the intent is fine. It is the business case. It puts in place some as- 
surances that there are basic project management capabilities 
there associated with this investment or this project. So that is all 
well and good. I think an opportunity to streamline that over time, 
so it is not a writing exercise where contractors are filling their 
pockets, that should probably be looked at. 

But going back to one of your original questions, what are the 
consequences of submitting an Exhibit 300 that is, one, either inac- 
curate, or two, that shows that this project isn’t ready to go for- 
ward and spend money, there should be real consequences. I think 
Ms. Evans pointed out some of these projects, like TRICARE, we 
have to keep going forward and we have to fund them and we have 
to try to fix them on the fly. But they are not all TRICARE. Using 
the apportionment process and withholding money, that matters, 
and if we did that more, maybe folks would take it a bit more seri- 
ous. 

Chairman COBURN. OK. Ms. Evans, you mentioned in your open- 
ing statement the decision to post Exhibit 300s, I think is very 
good for transparency, and to allow us to actually see those, I think 
will be very helpful. 

I think also the fact that the Congress ought to be aware of the 
high-risk list and ought to be aware of the Management Watch 
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List. It is our responsibility to oversee that and I think we have 
pretty much had an agreement from your boss that is going to be 
made available to us. Is that your understanding? 

Ms. Evans. About the Management Watch List and the high-risk 
list? 

Chairman CoBURN. Yes. 

Ms. Evans. Yes, sir. What we will do is we will provide the high- 
risk list that we have to you guys next week. 

What we would like to do, if it is OK with you, and my boss, is 
on the Management Watch List, what we do is we have a deadline 
on the scorecard of June 30. So we receive them in September and 
we work through the budget process with the agencies and then we 
have a deadline on the scorecard of June 30 where they have to re- 
mediate any of the weaknesses or have an adequate plan that 
shows that they are going to remediate the weakness that we have 
identified. If that hasn’t happened by June 30, which obviously the 
date has passed now so we can make the list available, we would 
like at that point to publish what is remaining on the Management 
Watch List so that Congress could then use that going forward in 
their own decisions that they want to make through the appropria- 
tions process. 

Chairman COBURN. The problem with that is, hopefully, most of 
the appropriations hearings and everything have already happened 
by that time, and so the decisions to really impact that will be a 
year and a half later. But we will work with you on that. 

Ms. Evans. OK. 

Chairman CoBURN. It is the obligation of the U.S. Congress to 
know what is not working right and to be able to hold oversight 
hearings on specific cases when they are not working right, we can 
be a tool for you. When it is not working right and we have that 
agency here with the Exhibit 300, with the budget and say, what 
went on here? 

We, myself and Senator Carper, have every intent to do that, is 
to help the rest of the agencies understand you are not going to 
skid this thing. We want to fund you. We want you to do what is 
right. We understand that your intent is to do what is right. But 
when it doesn’t work, we want to hold you accountable and for us 
to have the correct oversight and transparency, not just for us, but 
for the American people. 

Senator Carper and I have a bill that is going to go through this 
week, which 0MB is backing and we are very thankful for, that is 
going to allow the American people to know where the money went. 
All these contracts are going to be known. Everybody in America 
is going to know who has got the contracts, unless it is a national 
security issue. So that is going to help. 

But the point is, we need to do the specific oversight, and if we 
can’t know where the problem is because we can’t get the list of 
the problems from 0MB, then we don’t have the ability to carry out 
our constitutional function, which we consider very seriously on 
this Subcommittee. 

Senator Carper, do you have additional questions? 

Senator Carper. Yes, just a few, if I could. Again, I think this 
would be probably a question for Mr. Powner. We learned today 
that there are many problems with the oversight of at-risk infor- 
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mation technology projects. I am just asking your opinion. How 
much in cost overruns do you think we can expect to endure from 
the most at-risk information technology projects that make up the 
$7 billion that we have heard about? 

Mr. POWNER. So to project how much the overrun would likely 
be? I think that would be very difficult to do. I think the — I mean, 
that is tough. We look at a lot of individual projects. There is one 
project we looked at, Rescue 21, a Coast Guard communications 
system that isn’t on the high-risk list that overran $300 million in 
a very short period of time. That is very common. 

Senator Carper. The overrun was $300 million? 

Mr. PoWNER. Three-hundred million. There is a system that we 
have been tracking for years, environmental satellite system, a 
joint acquisition between DOD, NOAA, and NASA called NPOESS. 
It basically provides weather forecasting information. It is impor- 
tant for hurricane tracking, very important going forward. That 
project has gone over a 3-year period from $6 billion life cycle cost 
to $12 billion. OK, that is not on the list. So you could look at that. 

Senator Carper. Why not? 

Mr. PowNER. Well, that is one of our examples where we think 
the high-risk list is understated. So those are two examples that 
we pointed out in our reports. Rescue 21 at the Coast Guard and 
NPOESS 

Senator Carper. Let me stop you for just a second and just ask 
for something. Why do you suppose those are not on the list? 

Ms. Evans. And I agree with Mr. Powner that they should be on 
the list. What agencies have a tendency to do, and the way that 
we are measuring some of these things, which sometimes — and I 
agree that we need to improve this — is that agencies will have a 
tendency to rebaseline a project or 

Senator Carper. When you say rebaseline, give me that in plain 
English. 

Ms. Evans. What they do is, for example, if GAO is tracking the 
same project by a different name and it is going on for 10 years, 
agencies will have a tendency when a project is deemed a failure 
or needs to be redone, will say, OK, after 5 years, this project 
hasn’t been successful. So they will rebaseline it and 

Senator Carper. What is rebaseline? 

Ms. Evans. They will zero it out and they will count it as a sunk 
cost and they will give us a new Exhibit 300, so it will show as 
something new. So I am going to give you a quick example of how 
this would work. 

Senator Carper. OK. 

Ms. Evans. So we track by agencies, like number of business 
cases that they will submit. So last year we saw a big drop. You 
can see it right here. There was 1,087 major investments that came 
in and it dropped to 857. That is a big flag for me, going, what has 
happened here? Did people actually finish projects and stop? Be- 
cause the dollar amount is the same. So something has happened 
in the way that these agencies are putting together the invest- 
ments and putting together the business cases. 

We went through agency by agency. So I have one specific agen- 
cy — 

Senator Carper. That is a lot to go through. 
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Ms. Evans. Yes, it is, but, that would be the question that I 
would figure my boss would ask me. What is the difference? What 
is the drop? Why do you see this change? Because we are collecting 
all these numbers now, we should be able to analyze them. 

So I looked at who were the biggest deviants that happened here 
and we had one agency that in fiscal year 2006, they had 51 busi- 
ness cases. In fiscal year 2007, they went to 34. So I sent them an 
e-mail. You should be able to answer this question fairly quickly 
and say what happened to the other 17. Because when we look at 
it, there are several of them that had brand new names. But when 
you look at how the dollars are broken out, there is development, 
modernization, enhancement, which is supposed to be new dollars, 
and steady state, which is supposed to be existing systems. 

So I asked them, I said, what happened to these 17 business 
cases? You should be able to tell me. I want to know by the end 
of the day, because that gets to your contractor issue. You should 
be able to answer this question if you are managing it. So the agen- 
cy did come back and say, OK, we have recategorized this. Twelve 
of them went into what we have as the single business case for of- 
fice automation. Four are actually brand new. We actually com- 
pleted one, and so that is off the list, and we restructured. So that 
is the rebaselining. We restructured four of those and we canceled 
one. So when you look at it, they redistributed their portfolio in a 
way that they thought that they could better manage it. 

But we do go agency by agency to ask them what they are doing 
with those so that you are not kind of flying under the radar screen 
or that you are just doing certain things. So in these particular 
cases, what will happen is GAO will track it through the entire re- 
quirement. It could take 25 years on some of these things. What 
we are tracking is if they ended and then they start a new one be- 
cause they said that they have done all of these different things, 
it becomes a new investment for us. So there is a difference be- 
tween the way GAO is tracking them and the way that we get the 
information from the agency. 

Senator Carper. All right. Thank you. 

Mr. Powner, I interrupted you in order to ask that question of 
Ms. Evans. Do you want to pick up your train of thought? 

Mr. Powner. Well, just to round out, I think that is a very im- 
portant point that Ms. Evans made on the rebaseline. Basically 
what rebaselining is is you start over. When we track in the Presi- 
dent’s Management Agenda, that is a high bar, to OMB’s credit. To 
have all major projects within 10 percent of cost, schedule, and per- 
formance, used earned value techniques, that is a very high bar. 

The concern would be what some agencies do is — our cost is $200 
million on this. We rebaseline it. We bump it up to $300 million. 
So now we are within 10 percent. It is kind of a “get out of jail 
free” card, just because they moved the total up that we are meas- 
uring from. That is what rebaselining is all about, so it is very im- 
portant to look at these numbers to make sure. 

And I am sure if we looked in detail at some of these projects 
that aren’t on the high-risk lists at DOD and other places, it is 
probably due to rebaselining. So it is something we are all aware 
of and we will keep our eye out for. 

Chairman CoBURN. Do you have a rebaseline list that you follow? 
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Ms. Evans. No, I don’t maintain a rebaseline list. 

Chairman CoBURN. Should we? I mean, that is really gaming the 
system. 

Ms. Evans. Well, we can. And what we do — some of the agen- 
cies — the term relentless has been associated with my name 

[Laughter.] 

Chairman COBURN. I like that. 

Ms. Evans [continuing]. That I have been pretty stringent about 
what you can and what you can’t do on some of these major invest- 
ments. But we do recognize that at a certain point, you have to be 
able to produce an audit trail so that GAO can track the history. 
But at a certain point, you do have to, like, start to ensure that 
they actually do have management practices, because some of these 
projects were so bad that if we kept all that information in there, 
they would never be able to show that they actually have the right 
progress and the right management practices in place and that 
they are now managing that effort to 10 percent of cost, schedule, 
and performance. But that is a very conscious decision and agreed- 
upon point between 0MB and the agency before we allow an agen- 
cy to rebaseline. 

Chairman CoBURN. My point would be is that ought to be a pol- 
icy and a reporting policy inside 0MB, because no matter who the 
Administration is, you want to be able to track that. That ought 
to be something that happens all the time so that we know, as a 
performance indicator. That is just a suggestion. 

Ms. Evans, is GAO reporting their examples in their report in 
June about the projects that weren’t on the high-risk list or on the 
watch list. The ones they reported, are they now on the list? 

Ms. Evans. Yes. Actually, we have gone back very specifically 
and asked. I am very intimately aware of the Census issue, sir. 

Chairman COBURN. I am announcing today I am going to send 
a letter to every agency asking every IT project that they have and 
where they are and where they are in terms of cost overrun. We 
are going to look at those. We are going to help you. 

Ms. Evans. OK. 

Chairman CoBURN. We are going to expect them to respond and 
also list by vendor so that we can look at it. I am convinced that 
you all are trying to do the right thing, and I think Senator Carper 
is, too, but I think we need more oversight and I certainly believe 
that we need the recommendations that we saw in the GAO report 
instituted as best as we can, and maybe some of the new ones that 
Mr. Powner brought forward today. 

We have great IT companies in this country, but we don’t want 
them to get to be lazy and we want to hold them accountable as 
well as the agencies accountable. My hope is that in the next cou- 
ple of months, we will single out two or three projects and look at 
those to see why they are not meeting what they need to do. We 
have done it on the Defense Travel System. I have tried to win. I 
have lost on that. The vendor is stronger than I am on the floor 
and we have spent $500 to $600 million on something we could 
have gotten for $30 million, and when they redo all the computers 
in the Pentagon, DTS isn’t going to work. They are doing a good 
job of trying to do that, but it is a half-a-billion dollars of our kids’ 
money that we have thrown out the door. 



26 


We can’t have any more of those. We just have to do a better job. 
I am talking about us. Senator Carper and I are committed to do 
the oversight that is necessary and we want to help you. We don’t 
want to be your adversaries. We want to be your supporters and 
we want to shine sunshine on areas that are weaknesses and allow 
good ideas to filter up to hold people accountable. 

Anything further? 

Senator Carper. Just to follow up on what the Chairman said, 
just in terms of reaching out to all the agencies and asking them 
to come back with the information that he has mentioned, some- 
times I say to my staff, help me to be a guided missile as opposed 
to being an unguided missile. If you were to give some friendly ad- 
vice and constructive advice as to how we might craft the kind of 
inquiry used just to describe it, do you have any thoughts now as 
to how it would be most constructive and most helpful to the work 
that you are trying to do, that would be welcome. If you don’t have 
anything right off the bat to share with us, maybe you could within 
the next 24 or 48 hours. That would be, I think, helpful to us. 

Ms. Evans. OK. 

Chairman COBURN. Thank you all very much for your testimony 
and your cooperative nature. We look forward to working 

Senator Carper. Mr. Chairman, could I interrupt just one quick 
minute? 

Chairman CoBURN. Yes, sure. 

Senator Carper. Ms. Evans indicated that one of the adjectives 
that she used to describe her is relentless, and I heard you talking 
about the Department of Defense Travel System and how you were 
outmanned on the floor. One of the adjectives that is used to de- 
scribe the Chairman, and I hope me, is relentless, as well, and this 
is a good one to be relentless on. Thank you. 

Chairman COBURN. Thank you all for being here. Thanks for 
your effort, and thank you for the service to our country. 

Ms. Evans. Thank you. 

Chairman COBURN. The hearing is adjourned. 

[Whereupon, at 10:50 a.m., the Subcommittee was adjourned.] 
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Good morning, Mr. Chairman and Members of the Committee. My remarks will focus 
on the Administration’s strategy and progress in planning, managing, and measuring the 
results of the Federal government’s information technology (IT) investments. 

The President proposed to spend roughly $64 billion in FY 2007 for IT and associated 
support services to support the multiple and wide-ranging missions of the Federal 
government. When performing appropriately, these IT investments help improve the 
ability of the government’s programs and operations to more effectively deliver services, 
products, and information to state, local, and tribal governments, industry, non-profit 
organizations, and the American people. 

In particular, you have requested a discussion of two specific tools we use throughout the 
year to manage IT investments - the “management watch list” and our “high risk” 
projects. While I will do so, I would like to first discuss our overall process for managing 
investments given all of our tools. 0MB executes its responsibilities using various 
methods such as 

• reviewing agencies’ annual budget submissions, 

• engaging with agencies throughout the year on such issues as the electronic 
government scorecard of the President’s Management Agenda, and 

• monitoring specific projects of interest to OMB - high risk projects 

IT Investments and The Budget Cycle 

Each year, OMB updates and issues guidance to the agencies for preparing, submitting 
and executing the budget.' Agency submissions must reflect the policies of the President 
- including implementation of the President’s Management Agenda initiatives. 

Two sections of this Circular provide additional guidance about IT funding requests 
specifically targeted at agency project planning.^ Specific questions are asked on 


‘ Circular A-1 1, “Preparation, Submission, and Execution of the Budget” , 
http://www.whitehouse.gov/omb/budget/fy2007/ 
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performance goals and measures, project management, alternatives analysis, earned value 
management, security plans, and privacy impact assessments. 

For major IT projects, agencies answer these questions and provide supporting details in 
a “Capital Asset Plan and Business Case” (business case). OMB reviews and evaluates 
these business cases as part of our overall evaluation of their entire agency budget 
submission. It is important to note, business cases are primarily planning documents and 
do not reflect actual project performance. Performance information is obtained through 
other means I will describe later. 

Our summary of where agencies stand with their plaiming for IT Investments (also called 
the “management watch list)”is reported as part of Chapter 9 of the Analytical 
Perspectives Chapter of the Budget.^ 

This report is an OMB requirement under the Clinger-Cohen Act (the net program 
performance benefits achieved by executive agencies as a result of major capital 
investments in information systems). As I have discussed in previous testimony on 
similar topics, the Clinger-Cohen Act establishes processes for executive agencies to 
analyze, track, and evaluate the risks and results of major capital investments for 
information systems. 

It is important to note, OMB is but one of the intended audiences for the business case - 
the primary audiences are agency officials and their investment review boards. These 
managers should use the business cases to effectively manage their own IT portfolios and 
submit to OMB only those investment requests meeting criteria specified in law, OMB 
policies and supporting the priorities of the Administration. 

For the FY 08 budget cycle, we have modified these exhibits to add appropriation code 
information to better target our spending dollars. Agencies are also required to post on 
their agency website, within 2 weeks of the release of the President’s budget, these 
updated exhibits reflecting final Presidential decisions. These products are included in 
agency Information Dissemination Product Inventories, Priorities, and Schedules and 
expose agency spending to even greater scrutiny by the taxpayer. 

The Management Watch List in FY2006 and FY2007 

Business cases reflecting one or more planning weaknesses are placed on the so-called 
“management watch list” and are targeted for followup and correction. 

As I have said, the information included in each business case helps OMB and the 
agencies ensure correctly planned IT investments. The President’s Budget for FY2006 
included approximately 1087 major IT projects, totaling about $65 billion. Of this 


^ Section 53, “Information Technology and E-Govemment” and Section 300, “Planning, Budgeting, 
Acquisition, and Management of Capital Assets.” 

’ http://\TO’w.whitehouse.gov/omb/budget/IV2007/ 
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number, 0MB reported 342 projects, representing about $15 billion — ^as being on a 
“management watch list.” 

We continue to use the “management watch list” as one of many tools to oversee 
agencies’ planning for IT investments and drive improved portfolio management. The 
FY2007 President’s budget proposes approximately $64 billion for IT and associated 
support services. Of the 857 business cases submitted this year, there were 263, valued at 
$9.9 billion, not meeting the criteria for success. As of this hearing, I am pleased to 
report this year’s list has been reduced to 86 projects valued at $4.5 billion. 

Improving Project Performance 

Having described a business case as a planning document and the management watch list 
as one tool used by OMB to monitor agency planning, let me now describe how other 
tools are used to monitor actual project execution and performance. In doing so, one will 
see as OMB does, over emphasis on the management watch list may produce unintended 
results. 

Although business cases include information designed to identify whether the agency 
appropriately considered project performance as part of the project planning, they are but 
a snapshot in time and are not designed to be nor are they used for measuring project 
performance (i.e., whether the project is within cost, schedule and performance goals). 
Managing and measuring project performance is of course first and foremost an agency 
responsibility. 

While over the past several years, agencies have improved the quality of their IT project 
planning and justification, we recognized we need to continue this improvement during 
the execution phase of the IT project. This time last year, we issued new guidance 
specifically to assist agencies in monitoring and improving project planning and 
execution and implementing earned value management for IT projects.'' 

Specifically, our guidance describes procedures regarding: 

• Establishing and validating performance measurement baselines with clear cost, 
schedule and performance goals; 

• Managing and measuring projects to within ten percent of these goals using a 
standard earned value management process established by the American National 
Standards Institute; 

• Assigning to each project a qualified project manager; and 

• Avoiding duplication by using inter-agency and government-wide investments to 
support common requirements; 

• Ensuring performance goals are appropriate. 


^ http://www.whitehouse.gov/omb/inemoranda/200S.html 
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The objective is to manage the risk associated with the IT investment to achieve the 
intended outcomes. Each quarter agencies evaluate and report to us on the performance 
of high risk projects. These projects are high risk, not at-risk, thus the definition of "high- 
risk" — those requiring special attention from the highest level of agency management and 
oversight authorities, including 0MB, agency Inspectors General, and GAO. For 
example, a project may be classified as high-risk because of exceptionally high costs and 
even if this project is performing well, it is still classified as high risk. 

The goal is for oversight authorities and agency management to have data on how these 
projects are performing at least quarterly to better ensure improved execution and 
performance. Agency managers and oversight authorities should know within 90 days if 
a project is not performing well. The goal is to manage project risk and avoid problems 
or catch them early should they occur before taxpayers’ dollars are wasted. 

It is also important to note this policy is designed to supplement and complement existing 
oversight and internal agency processes, not replace them. This policy is separate and 
apart from the “management watch list” discussed and presents oversight authorities with 
information differing in focus, timing, and expected results. 

Using the President’s Management Agenda Scorecard to Assist Oversight 

0MB oversees the agencies’ activities under the President’s Management Agenda and its 
associated quarterly reporting process. 

The Expanding Electronic Government Scorecard includes the following standards for 
success. To get to green, agencies must: 

• Have an effective Enterprise Architecture; 

• Demonstrate they are managing their major IT projects so they deliver results 
as expected, on-time and within budget; 

• Secure at least 90% of operational systems and sustaining progress correcting 
security weaknesses through a Department-wide remediation process verified 
by the agency Inspector General or the Head of the Agency; 

• Avoid redundant or agency-unique IT projects by participating in 
government- wide E-Gov initiatives and Lines of Business; and 

• Justify successfully major IT investments with complete business cases 

Each quarter agencies receive a scorecard about their progress and status in achieving the 
Government-wide goals. We deliberately included a criterion for “acceptable business 
cases” to underscore it is at its core an essential management issue. 

Again, the acceptability of businesses cases is just one of a number of critical 
components agencies must satisfy to get to green (or yellow) for the E-Government 
scorecard. If the business case criteria are not successfully met, agencies cannot move 
forward, regardless of their performance against other E-Government criteria. Agency 
scores are posted quarterly at http://results.gov/agenda/scorecard.html . 
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Follow-up is dependent on the particular issues identified and tends to focus on strategic 
issues or problems existing at a government-wide or agency- wide programmatic level, 
not tactical ones residing with individual investments. 

For example, in our work for the President’s FY 07 budget, we noted while more than 
70% of major IT investments had a qualified project manager, there continued to be gaps 
in project management capabilities. In many cases, a qualified project manager supported 
more than one investment, diminishing their overall effectiveness and increasing project 
risks. To further strengthen our project management capability, we have subsequently 
provided additional guidance through the President’s Management Agenda Human 
Capital scorecard to reduce gaps in mission-critical occupations and competencies. 

Additionally, our oversight of agency investment requests over the past two years ago, 
identified widespread weaknesses in agencies meeting cost, schedule and performance 
goals. Therefore, we now emphasize earned value management as a key feature in the 
quarterly President’s Management Agenda scorecard reviews. 

Finally, a recent GAO report revealed questions on the validity of agency information in 
the Exhibit 300s submitted to 0MB. We are working with each of the agencies to correct 
these problems and ensure they do not occur in the future, 

I would now like to discuss two examples of how our policies and oversight have helped 
agencies succeed on projects to reduced costs and burden on industry and the public. 

The Shipper’s Export Declaration is the most common form of export documentation 
files by the U.S. exporter community. Information collected on the form is used by the 
U.S. Census Bureau to compile trade statistics and help prevent illegal exports. The 
Automated Export System and the associated website (AESDirect.gov) automated the 
formerly manual, paper-based process of filing the Shipper’s Export Declaration and 
related export documentation. AESDirect.gov, the Census Bureau’s free Internet-based 
system, can be used directly by exporters and anyone else responsible for export 
reporting. This saves exporters time and effort in filing required forms, reduces time and 
resources required by the Census Bureau for processing the data, and provides the 
Federal government more timely and accurate trade information for the monthly principle 
economic indicator, “U.S. International Trade in Goods and Services.” 

Overall the use of the Automated Export System has reduced reporting burden by 
167,000 hours and reduces the cost of filing Shipper’s Export Declarations from $50 for 
paper forms to $1 .50 when filed electronically. 

Another example of successful agency implementation of sound policies is the National 
Highway Traffic Safety Administration’s collection of data from over 650 manufacturers 
of vehicles, child safely seats, tires, and motor vehicle equipment. Successfully 
automating this process has reduced costs to manufacturers by an estimated $1.2 million 
dollars per year and improves access to the information for more timely analysis. Over 
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9,000 users visit the site each data to access real-time data on prior investigations, recalls, 
and consumer complaints. 

Conclusion 

Thank you for this opportunity to discuss the Administration’s strategy and progress to 
date in planning, managing, and measuring the results of the government’s IT 
investments. As we continue to work with agencies to improve the planning, execution, 
and management of IT projects, we will also continue to look for new opportunities to 
refine our oversight. 
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What GAO Found 

As a result of the Management Watch List and high risk projects processes, 
about 300 projects totaling about S12 billion in estimated IT expenditures for 
fiscal year 2007 have been identified as being either poorly planned or poorly 
performing. SpedficaHy, of the 857 major IT projects in the President's 
budget for fiscal year 2007 , OMB placed 263 projects, representing about $10 
billion on its Management Watch Ust In addition, in response to OMB's 
memorandum, agencies reported that 79 of 226 high risk projects, 
collectively totaling about $2.2 bOlion, had a performance shortfall. 

While this information helps to focus both agency and OMB management 
attention on these poorly planned and poorly performing projects, GAO 
identified opportunities to strengthen how these projects are identified and 
provided oversight. 

• The Management Watch Ust may be undermined by maccurate and 
unreliable data. OMB uses scoring criteria to evaluate agencies’ exhibit 
300s to derive the projects on its Management Watch List. GAO's detailed 
evaluation of exhibit 300s showed that the information reported in them 
is not always accurate or supported by documentation. 

• The criteria for identifying high risk projects were not always 
consistently ^plied and projects that speared to meet the criteria were 
not identified as high risk. Without consistent application of the high risk 
criteria, OMB and agency executives cannot have the assurance that all 
projects that require special attention have been identified. 

• For both sets of projects, OMB did not develop a central list of projects 
and deficiencies that could facilitate Tracking progress and reporting to 
Congress. Without such lists, OMB is not fully exploiting the opportunity 
to analyze and track these projects on a govemmentwide basis and not 
involving Congress in the oversight of these projects with risks. 

To improve the way the Management Watch List and high risk projects are 
identified and provided oversight, GAO has made a number of 
recommendations to the Director of OMB. These recommendations include 
directing agency chief information officers to improve the accuracy and 
reliability of exhibit 300 information and to consistently apply the high risk 
criteria defined by OMB. In addition, GAO recommended that the Director 
develop a single, aggregate list for both the Management Watch List and high 
risk projects to faciUtate tracking progress, performing govemmentwide 
analysis, and reporting the results to Congress. OMB generally disagi^d 
with these recommendations. However, GAO believes that they are needed 
to provide greater assurance that poorly planned and poorly performing 
projects are more accurately identified and provided oversight, and 
ultimately ensure that potentlaliy billions of taxpayer dollars are not wasted. 
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Mr. Chairman and Members of the Subcommittee: 

I am pleased to be here today to discuss the federal government’s 
processes for improving the management of IT investments that 
total $64 billion for fiscal year 2007. Effective management of these 
investments is essential to the health, economy, and security of the 
nation. The Office of Management and Budget (0MB) plays a key 
role in overseeing federal IT investments. The Clinger-Cohen Act, 
among other things, requires 0MB to establish processes to analyze, 
track, and evaluate the risks and results of major capital 
investments in information systems made by executive agencies and 
to report to Congress on the net program performance benefits 
achieved as a result of these investments. 

To help carry out its role, 0MB has developed several processes to 
improve the management of federal IT projects, including the e-Gov 
scorecard,* Management Watch List, and high risk projects. The 
Management Watch List identifies projects with weaknesses in their 
funding justifications (or exhibit 300s) based on an evaluation of 
these documents. High risk projects are projects requiring special 
attention from oversight authorities and the highest level of agency 
management because of one or more of the following four reasons’* 
(1) the agency failed to demonstrate the ability to manage complex 
projects; (2) the projects has exceptionally high development, 
operating, or maintenance costs; (3) the projects are addressing 
deficiencies in the agencies’ ability to perform mission critical 
business functions; or (4) the projects’ delay or failure would impact 
the agencies’ essential business functions. Agencies are also 


The quarterly e-Gov Scorecards are reports that use a redyellow/green scoring si's!.©!!! to 
illustrate the results of OMB’s evaluation of agencies’ implementation of e-govemment 
criteria in the President’s Management Agenda. Itte scores are determined in quarterly 
reviews, where 0MB evaluates agency progress toward agreed-upon goals along several 
dimensions, and provides input to the quarterly reporting on the President’s Management 
Agenda. Key criteria used to score agencies e-govcmment process include acceptable 
business cases, cost and schedule performance; and security accreditation. As of June 30, 
2006, 21 of the 26 deparlntents/m^or agencies were identified as having a yellow (mixed 
results) or red (unsatisfactory) score. 

^ These reasons axe speciTied in 0MB, Memorandum to Chief Information Officers: 
Improving Information Technology Project Planning and Execution , M-05-23 
(Washington, D.C., Aug. 4, ^)05), 
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required to provide quarterly reports to 0MB on identified high risk 
projects that have performance shortfalls, meaning that they do not 
meet one or more of four performance evaluation criteria. The 
performance criteria are (1) establishing baselines with clear cost, 
schedule, and performance goals;(2) maintaining the project’s cost 
and schedule variances within 10 percent; (3) assigning a qualified 
project manner; or (4) avoiding duplication by leveraging 
interagency and govemmentwide investments. 

These processes, among other things, are instrumental in helping to 
identify and improve oversight of poorly planned and poorly 
performing projects. Given the importance of these processes, you 
asked us to summarize (1) the number of projects and fiscal year 
2007 dollar value of Management Watch List and high risk projects, 
(2) previously reported results on how these projects are identified 
and provided oversight, and (3) recommendations made to improve 
these processes. In preparing this testimony, we summarized our 
previous reports on initiatives for improving the management of 
federal IT investments.^ The work in these reports was performed in 
accordance with generally accepted government auditing standards. 


Results in Brief 


As a result of the Management Watch List and high risk projects 
processes, about 300 projects totaling about $12 billion in estimated 
IT expenditures for fiscal year 2007 have been identified as being 
either poorly planned or poorly performing. Of the more than 857 
major IT projects in the President’s budget for fiscal year 2007, OMB 
placed 263 projects, representing about $10 billion on its 
Management Watch List. In addition, in response to OMB’s 
memorandum, agencies reported that 79 of 226 high-risk projects, 
collectively totaling about $2.2 billion, had a performance shortfall 


■’ G\0. Infoimation Technology: OMB Can Make More Effective Use of Its Investment 
Reviews, (Washington, D.C.: April 15, 2005^/ Information Technology: Agencies 

Need to Improve the Accuracy and Reliability of Investment Infonnation, GAO-06-250 
(Washington, D.C.: Jan.l2, ^306); 6^40, Information Technology: Agencies and OMB Should 
Strengthen Processes for Identifying and Overseeing High Risk Projects, GAO-06-647 
(Washington, DC, June 15, 2006) 
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primarily associated with cost and schedule variances that exceeded 
10 percent. 

While this information helps to focus both agency and 0MB 
management attention on these poorly planned and poorly 
performing projects, our reviews identified opportunities to 
strengthen how these projects are identified and provided oversight 

• The Management Watch List may be undermined by inaccurate and 
unreliable data. 0MB uses scoring criteria to evaluate each m^or 
projects' justification for funding (known as exhibit 300s) to derive 
the projects on its Management Watch List Our detailed evaluation 
of exhibit 300s showed that the information reported in them is not 
always accurate or supported by documentation. 

. For the high risk projects, the criteria for identifying projects were 
not always consistently applied and we found examples of projects 
that appeared to meet the criteria but were not identified as high 
risk. Without consistent application of the high risk criteria, 0MB 
and agency executives cannot have the assurance that all projects 
that require special attention have been identified. 

• For both sets of projects, 0MB did not develop a central list of 
projects and deficiencies that could facilitate the tracking of 
progress and reporting to Congress, By not having such lists, 0MB 
is not fully exploiting the opportunity to analyze and track these 
projects on a govemmentwide basis and to involve Congress in the 
oversight of these projects with risks. 


To improve the way the Management Watch List and high risk 
projects are identified and provided oversight, we have made a 
number of recommendations to the Director of 0MB. These 
recommendations include directing agency chief information 
officers to improve the accuracy and reliability of exhibit 300 
information and to consistently applying the high risk criteria 
defined by OMB. In addition, we recommended that the Director 
provide for training of agency personnel responsible for completing 
exhibit 300s and to develop a single, aggregate list for both the 
Management Watch List projects and for high risk projects to 
facilitate tracking progress, performing govemmentwide analysis, 
and reporting the results to Congress. OMB generally disagreed 
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with our recommendations. However, we continue to believe that 
they are needed to help accurately identify poorly planned and 
performing projects and more effectively oversee these projects. 


Background 

Each year, 0MB and federal agencies work together to determine 
how much the government plans to spend for IT and how these 
funds are to be allocated. Federal IT spending has risen to an 
estimated $64 billion in fiscal year 2007. 

0MB plays a key role in overseeing federal IT investments and how 
they are managed. To drive improvement in the implementation and 
management of IT projects, Congress enacted the Clinger-Cohen Act 
in 1996 to further expand the responsibilities of 0MB and the 
agencies under the Paperwork Reduction Act* In particular, the act 
requires agency heads, acting through agency chief information 
officers (CIOs), to, among other things, better link their IT planning 
and investment decisions to program missions and goals and to 
implement and enforce IT management policies, procedures, 
standards, and guidelines. The Clinger-Cohen Act requires that 
agencies engage in capital planning and performance and results- 
based management' The act also requires OMB to establish 
processes to analyze, track, and evaluate the risks and results of 
major capital investments in information systems made by executive 
agencies. OMB is also required to report to Congress on the net 
program performance benefits achieved as a result of mqjor capital 
investments in information systems that are made by executive 
agencies.’ 

In response to the Clinger-Cohen Act and other statutes, OMB 
developed policy for planning, budgeting, acquisition, and 


* 44 US.C. § 3504(aXl)(BXviXOMB); 44 U.S.C. § 3B06(hX6) (agencies). 

’ 40 U,S.C. § 1 1312; 40 U.S.C. § 1 1313. 

® These requirements are specifically described in the Ciinger-Cohen Act, 40 U.S.C. § 11302 
(c). 
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management of federal capital assets. This policy is set forth in 0MB 
Circular A-ll (section 300) and in OMB’s Capital Programming 
Guide (supplement to Part 7 of Circular A-ll), which directs 
agencies to develop, implement, and use a capital programming 
process to build their capital asset portfolios. Among other things, 
OMB’s Coital Programming Guide directs agencies to 

• evaluate and select capital asset investments that will support core 
mission functions that must be performed by the federal 
government and demonstrate projected returns on investment that 
are clearly equal to or better than alternative uses of available public 
resources; 

• institute performance measures and management processes that 
monitor actual performance and compare to planned results; and 

• establish oversight mechanisms that require periodic review of 
operational capital assets to determine how mission requirements 
might have changed and whether the asset continues to fulfill 
mission requirements and deliver intended benefits to the agency 
and customers. 


To further support the implementation of IT capital planning 
practices, we have developed an IT investment management 
framework^ that agencies can use in developing a stable and 
effective capital planning process, as required by statute and 
directed in OMB’s Capital Programming Guide. Consistent with the 
statutory focus on selecting,® controlling,® and evaluating'® 


’ GAO, Information Technology Investment Management A Framework for Assessing and 
Improving Process Maturity, GAO-04-394G (Washington, D.C.: March 2004). 

* During the selection phase, the organization (1) identifies and analyzes each project’s 
risks and returns before committing significant funds to any project and (2) selects those 
FT projects tiiat will best support its mission needs. 

During the cOTitrol phase, the organization ensures that, as projects develop and 
investment expenditures continue, the project is continuing to meet mission needs at the 
expected levels of cost and risk. If the project is not meeting expectations or if problems 
have arisen, steps are quickly taken to adth^ss the deficiencies. 

During the evaluation phase, actual versus expected results are compared once projects 
have been fully implemented. This is done to (1) assess the project’s impact on mission 
performance, (2) identify any charges or modifications to the project that may be needed, 
and (3) revise the investment management process based on lessons learned. 
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investments, this framework focuses on these processes in relation 
to IT investments ^ecifically. It is a tool that can be used to 
determine both the status of an agency’s current IT investment 
management capabilities and the additional steps that are needed to 
establish more effective processes. Mature and effective 
management of IT investments can vastly improve government 
performance and accountability. Without good management, such 
investments can result in wasteful spending and lost opportunities 
for improving delivery of services to the public. 


Prior Reviews on Federal IT Investment Management Have Identified Weaknesses 

Only by effectively and efficiently managing their IT resources 
through a robust investment management process can agencies gain 
opportunities to make better allocation decisions among many 
investment alternatives and further leverage their investments. 
However, the federal government faces enduring IT challenges in 
this area. For example, in January 2004 we reported on mixed 
results of federal agencies’ use of IT investment management 
practices.” Specifically, we reported that although most of the 
agencies had IT investment boards responsible for defining and 
implementing the agencies’ IT investment management processes, 
agencies did not always have important mechanisms in place for 
these boards to effectively control investments, including decision- 
making rules for project oversight, early warning mechanisms, 
and/or requirements that corrective actions for underperforming 
projects be agreed upon and tracked. Executive-level oversight of 
project-level management activities provides organizations with 
increased assurance that each investment will achieve the desired 
cost, benefit, and schedule results. Accordingly, we made several 
recommendations to agencies to improve their practices. 

In previous work using our investment management framework, we 
reported that the use of IT investment management practices by 


GAO, Information Technology Management' Government wide Strategic Planning, 
Performance Measurement, and Investment Management Can Be Further Improved, GAO- 
()4-49 (Washin^on, D.C.: Jan. 12. 2004). 
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agenci(» was mixed. For example, a few agencies that have 
followed the framework in implementing capital planning processes 
have made significant improvements.'^ In contrast, however, we and 
others have continued to identify weaknesses at agencies in many 
areas, including immature management processes to support both 
the selection and oversight of major IT investments and the 
measurement of actual versus expected performance in meeting 
established performance measures. “ 


OMB’s Management Watch List Intended to Correct Project Weaknesses and Business 
Case Deficiencies 

In helping to ensure that investments of public resources are 
justified and that public resources are wisely invested, 0MB began 
using the Management Watch List, in the President’s fiscal year 2004 
budget request, as a means to oversee the justification for and 
planning of agencies’ IT investments. This list was derived based on 
a detailed review of the investments’ Capital Asset Plan and 
Business Case, also known as the exhibit 300. 

The exhibit 300 is a reporting mechanism intended to enable an 
agency to demonstrate to its own management, as well as 0MB, that 
a m^or project is well planned in that it has employed the 
disciplines of good project management; developed a strong 
business case for the investment; and met other Administration 
priorities in defining the cost, schedule, and performance goals 
proposed for the investment. 


These ^encies include the Departments of Agriculture, Commerce, and the Interior. 
’’For example, GAO, Information Technology: Centers for Medicare & Medicaid Services 
Needs to Establish Critical Investment Management Capabilities, GAO-06-12 (Washington, 
D.C.: Oct 28, 2®05); Information Technology: Departmental Leadership Crucial to Success 
of Investment Reforms at Interior, GAO-03-1028 (Washington, D.C.: Sept. 12, 2003); and 
United States Postal Service: Opportunities to Strengthen FT Investment Management 
Capabilities, GAO-03^ (Washington, D.C,: Oct. 15, 2002). 
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We reported in 2005 that 0MB analysts evaluate agency exhibit 300s 
by assigning to each exhibit 300 based on guidance presented 

in 0MB Circular A-1 U* As described in this circular, the scoring of a 
business case consists of individual scoring for 10 categories, as 
well as a total composite score of all the categories. The 10 
categories are 

• acquisition strategy, 

• project (investment) management, 

• enterprise architecture, 

• alternatives analysis, 

• risk management, 

• performance goals, 

• security and privacy, 

• performance*based management system (including the earned 
value management system’'^), 

• life-cycle costs formulation, and 

• support of the President’s Management Agenda. 

Using these scores, projects were placed on the Management Watch 
List if their exhibit 300 business case received a total composite 
score of 3 or less, or if it received a score of 3 or less in the areas of 
performance goals, performance-based management systems, or 
security and privacy, even if its overall score was a 4 or 5. To derive 
the total number of projects on the list that were reported for fiscal 
year 2005, OMB polled the individual analysts and compiled the 
numbers. 

According to OMB, agencies with weaknesses in these three areas 
were to submit remediation plans addressing the weaknesses. OMB 
officials also stated that decisions on follow-up and monitoring the 


“ GAO-05-276. 

Earned value management is a project management tool that integrates the investment 
scope of woric with schedule and cost elements for investment planning and control. This 
method compares the value of work accomplished darii\g a given period with that of the 
work expected in the period. Differences in expectations are measured in both cost and 
schedule variances. 
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progress were typically made by staff with responsibility for 
reviewing individnal agency budget submissions, depending on the 
staffs insights into agency operations and objectives. According to 
0MB officials, those Management Watch List projects that did 
receive specific follow-up attention received feedback, among other 
means, through the passback process, through targeted evaluation 
of remediation plans designed to address weaknesses, and through 
the apportioning of funds so that the use of budgeted dollars was 
conditional on appropriate remediation plans being in place, and 
through the quarterly e-Gov Scorecards. 


0MB Issued August 2005 Memorandum on Improving Performance of High Bisk IT 
Projects 

To improve IT project execution, 0MB issued a memorandum in 
August 2005 to ail federal CIOs, directing them to begin taking steps 
to identify IT projects that are high risk and to report quarterly on 
their performance." As originally defined in 0MB Circular A-ll and 
subsequently reiterated in the August 2005 memorandum, high risk 
projects are those that require special attention from oversight 
authorities and the highest levels of agency management because of 
one or more of the following four reasons: 

• The agency has not consistently demonstrated the ability to 
manage complex projects. 

• The project has exceptionally high development, operating, or 
maintenance costs, either in absolute terms or as a percentage of 
the agency’s total IT portfolio. 

• The project is being undertaken to correct recognized 
deficiencies in the adequate performance of an essential mission 
program or function of the agency, a component of the agency, or 
another organization. 

. Delay or failure of the project would introduce for the first time 
unacceptable or inadequate performance or failure of an 
essential mission function of the agency, a component of the 
agency, or another organization. 


** 0MB Memorandum, M-(®-23 (Aug. 4, 2005). 
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As directed in the memorandum, agencies are to work with OMB to 
identify their high risk IT projects using these criteria. 2006. Most 
agencies reported that, to identify high risk projects, CIO office staff 
compared the criteria against their current portfolio to determine 
which projects met OMB’s definition. They then submitted the list to 
OMB for review. According to OMB and agency officials, after the 
submission of the initial list, examiners at OMB worked with 
individual agencies to identify or remove projects as appropriate. 
According to most agencies, the final list was then approved by their 
CIO. 

For the identified high risk projects, beginning September 15, 2005, 
and quarterly thereafter, CIOs were to assess, confirm, and 
document projects’ performance. Specifically, agencies were 
required to determine, for each of their high risk projects, whether 
the project was meeting one or more of four performance evaluation 
criteria- (1) establishing baselines with clear cost, schedule, and 
performance goals; (2) maintaining the project’s cost and schedule 
variances within 10 percent; (3) assigning a qualified project 
manager; and (4) avoiding duplication by leveraging inter-agency 
and govemmentwide investments. If a high risk project met any of 
these four performance evaluation criteria, agencies were instructed 
to document this using a standard template provided by OMB and 
provide this template to oversight authorities (e.g., OMB, agency 
inspectors general, agency management, and GAO) on request. 

Upon submission, according to OMB staff, individual analysts 
review the quarterly performance reports of projects with shortfalls 
to determine how well the projects are progressing and whether the 
actions described in the planned improvement efforts are adequate 
using other performance data already received on IT projects such 
as the e-Gov Scorecards, earned value management data, and the 
exhibit 300. 
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Poorly Planned and Performing Projects Identified, Totaling About 
$12 Billion in Estimated Expenditures for Fiscal Year 2007 

About 300 projects totaling about $12 billion in estimated IT 
expenditures for fiscal year 2007 have been placed on OMB’s 
Management Watch List or as a high risk project with performance 
shortfalls. Specifically, the President's budget for fiscal year 2007 
included 867 m^or IT projects, totaling approximately $64 billion. 
Of this, OMB reported that there were 263 proposed major projects 
that were poorly planned, totaling $10 billion. In addition, agencies 
reported that 79 of the 226 high-risk projects identified as of March 
2006, collectively totaling about $2.2 billion had a performance 
shortfall primarily associated with cost and schedule variances that 
exceeded 10 percent. 

OMB has reported on the Management Watch List in the President’s 
budget request for 2004. While the number of projects and their 
associated budget have decreased since then, they still represent a 
significant percentage of the total IT budget. Table 1 shows the 
budget information for projects on the Management Watch List for 
fiscal years 2004, 2005, 2006, and 2007. 


Table 1 : Management Watch List Budget for Fiscal Years 2004, 2005, 2005, and 2007 

Fiscal Years 

Total IT 
budget (in 
billions) 

IT budget for 
Management 
Watch List 
projects <in 
billions) 

Percentage of 
budget for 
Management 
Watch List 
projects 

2004 

$59.0 

$20.9 

35% 

2005 

$60.0 

$22.0 

37% 

2006 

$65.0 

$15,0 

23% 

2007 

$64.0 

$9.9 

15% 


Sotms; OAO analysis o) OMB data. 


Table 2 provides the number of projects on the Management Watch 
List for fiscal years 2004, 2005, 2006, and 2007. 
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Table 2: Number of Projects on Management Watch List for Fiscal Years 2004, 2005, 
2006, and 2007 

Fiscal Years 

Total IT 
projects 

Management 
Watch List 
projects 

Percentage of 
projects on 
Management 
Watch List 

2004 

1400 

771 

55% 

2005 

1200 

621 

52% 

2006 

1087 

342 

31% 

2007 

857 

263 

31% 


Source; GAO anai/^s M 0MB dale. 


In addition, in response to OMB’s August 2006 memorandum, the 24 
msuor agencies identified 226 IT projects as high risk, totaling about 
$6.4 billion in funding requested for fiscal year 2007". Agencies 
identified most projects as high risk because their delay or failure 
would impact the essential business functions of the agency. In 
addition, agencies reported that about 35 percent of the high risk 
projects — or 79 investments, collectively totaling about $2.2 billion 
in fiscal year 2007 — had a performance shortfall, primarily 
associated with cost and schedule variances that exceeded 10 
percent 

Figure 1 illustrates the number of agency high risk projects as of 
March 2006 with and without shortfalls. The majority of the agencies 
reported that their high risk projects did not have performance 
shortfalls in any of the four areas identified by 0MB. In addition, six 
agencies — the departments of Commerce, Energy, Housing and 
Urban Development, and Labor, and the National Aeronautics and 
Space Administration and the National Science Foundation — 
reported that none of their high risk projects experienced any 
performance shortfalls. 
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Figure 1 : Number of Agencies High Risk Projects with and w^hout Performance Shoitfaiis (as of March 2006} 


Number of projects 
35 



Agency 

[ I Projects with no performance shortfalls 

[' ■ ~>'[ Projects with performance shortfalls 

Source: GAO analysis o< 24 CFO agencies' Match 2006 high risk reports. 

Note: O9partmer>tolAgfteullure0JSOA); Department Of Heath and Humar» Services (HH8); Department of HomsIandSecurttyfDHSj; 
Oepatimoflt of Housing and Uitan Developmew (HUD); Oeparimeniof Veieratw Allairs (VA); Environmettlal Protection Agency (EPA); 
General Services Administration (GSA); National Aeronautics and Space Administration (NASA); National Science Foundation (N8F); 
Nuetear Peguiaiory Commissjon (NRC); OBice of Personnel Management (0PM); Small Susiness Administration (SBA); Sobal Security 
Administration (S5A); Agency for intemailonal Oevelopmem (uSAiD) 
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Improvements Needed to Identify and Oversee Management Watch 
List and High Risk Projects 


While the Management Watch List and high risk processes serve to 
highlight poorly planned and performing projects and focus 
attention on them, our reviews identified opportunities to 
strengthen the identification and oversight of projects for each. 


Management Watch List May Be Based on Unreliable Data and High Risk Project 
Criteria Are Not Always Consistently Applied 

OMB’s Management Watch List may be undermined by inaccurate 
and unreliable data. While 0MB uses the exhibit 300s as the basis 
for designating projects as poorly planned, we have recently 
reported'* that the underlying support was often inadequate for 
information provided in the exhibit 300s GAO reviewed. Three 
general types of weaknesses were evident: 

• All exhibit 300s had documentation weaknesses. Documentation 
either did not exist or did not fully agree with specific areas of the 
exhibit 300. 

• Agencies did not always demonstrate that they complied with 
federal or departmental requirements or policies with regard to 
management and reporting processes. Also, none had cost analyses 
that fully complied with 0MB requirements for cost-benefit and 
cost-effectiveness analyses. In contrast, most investments did 
demonstrate compliance with infonnation security planning and 
training requirements. 

• In sections that required actual cost data, these data were umeliable 
because they were not derived from cost-accounting systems with 


'* GAOt»-250. 
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adequate controls. In the absence of such systems, agencies 
generally derived cost information from ad hoc processes. 

Moreover, although agencies, with OMB’s assistance, generally 
identified their high risk projects using criteria specified by 0MB, 
these criteria were not always consistently applied. 


• In several cases, agencies did not use OMB’s criteria to identify high 
risk projects. Some agencies reported using other reasons to 
identify a total of 31 high risk projects. For example, the Department 
of Homeland Security reported investments that were high risk 
because they had weaknesses associated with their business cases 
based on the evaluation by OMB. The Department of Transportation 
reported projects as high risk because two did not have approved 
baselines, and four had incomplete or poor earned value 
management assessments. 


• Regarding the criterion for high risk designation that the agency has 
not demonstrated the ability to manage complex projects, only three 
agencies reported having projects meeting this criterion. This 
appears to be somewhat low, considering that we and others have 
previously reported on weaknesses in numerous agencies’ ability to 
manage complex projects. For example, we have reported in our 
high risk series on mgjor programs and operations that need urgent 
attention and transformation in order to ensure that our national 
government functions in the most economical, efficient, and 
effective manner possible." Specifically, the Department of 
Defense’s efforts to modernize its business systems have been 
hampered because of weaknesses in practices for (1) developing 
and using an enterprise architecture, (2) instituting effective 
investment management processes, and (3) establishing and 
implementing effective systems acquisition processes. We 
concluded that the Department of Defense, as a whole, remains far 
from where it needs to be to effectively and efficiently manage an 
undertaking with the size, complexity, and significance of its 


GAO, Senes: A/I Update, Gi4(?-CK^-^(?7(Washington. D.C., January 2005). 
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departmentwide business systems modernization. We also reported 
that, after almost 25 years and $41 billion, efforts to modernize the 
air traffic control program of the Federal Aviation Administration, 
the Department of Transportation’s largest component, are far from 
complete and that projects continue to face challenges in meeting 
cost, schedule, and performance expectations.” However, neither 
the Department of Defense nor the Department of Transportation 
cited the “inability to manage complex projects" criteria for any 
projects as being high risk. 


• Finally, while agencies have reported a significant number of IT 
projects as high risk, we identified other projects on which we have 
reported and testified that appear to meet one or more of OMB’s 
criteria for high risk designation including high development or 
operating costs and recognized deficiencies in the adequate 
performance but were not identified as high risk. Examples we have 
recently reported include the following projects: 


. The Deceimial Response Integration System of the Census 
Bureau, is intended to integrate paper, Internet, and telephone 
responses. Its high development and operating costs are 
expected to make up a large portion of the $1.8 billion program 
to develop, test, and implement decennial census systems. In 
March 2006,“ we testified that the component agency has 
established baseline requirements for the acquisition, but the 
bureau has not yet validated them or implemented a process for 
managing the requirements. We concluded that, until these and 
other basic contract management activities are fully 
implemented, this project faced increased risks that the system 
would experience cost overruns, schedule delays, and 
performance shortfalls. 


• The National Polar-Orbiting Operational Environmental Satellite 
System — an initiative managed by the Department of Commerce, 


“QAO-05-207. 

GAO, Census Bureau: Important Activities tea: Improving Management of Key2010 
Decennial Acquisitions Remain to be Done, GAO-06-i44T (Washington, D.C.: RIar. i, 2006). 
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the Department of Defense, and the National Aeronautics and 
Space Administration — is to converge two satellite programs into 
a single satellite program capable of satisfying both civilian and 
military requirements. In November 2005,^ we reported that the 
system was a troubled program because of technical problems on 
critical sensors, escalating costs, poor management at multiple 
levek, and the lack of a decision on how to proceed with the 
program. Over the last several years, this system has experienced 
continual cost increases to about $10 billion and schedule delays, 
requiring difficult decisions about the program’s direction and 
capabilities. More recently, we testified® that the program is still 
in trouble and that its future direction is not yet known. While the 
program office has corrective actions under way, we concluded 
that, as the project continues, it will be critical to ensure that the 
management issues of the past are not repeated. 


• Rescue 21, is a planned coastal communications system of the 
Department of Homeland Security. We recently reported® that 
inadequacies in several areas contributed to Rescue 21 cost 
overruns and schedule delays. These inadequacies occurred in 
requirements management, project monitoring, risk management, 
contractor cost and schedule estimation and delivery, and 
executive level oversight. Accordingly, the estimated total 
acquisition cost has increased from $250 million in 1999 to $710.5 
million in 2005, and the timeline for achieving full operating 
capability has been extended from 2006 to 2011. 


For the projects we identified as appearing to meet OMB’s criteria 
for high risk, the responsible agencies reported that they did not 
consider these investments to be high risk projects for such reasons 


® GAO, Polar-Orbiting Operation^ Environmental Satellites: Technical Problems, Cost 
Increa^ and Schedule Delays Trigger Need for DifRcult Trade-Off Decisions, GAO-06- 
249T (Washington, D.C.: Nov. 16, 2005). 

® GAO, Polar-Orbiting Operational Environmental Satellites: Cost Increases Trigger Review 
and Place Program ’s Direction on Hold, GAO-06-573T (Washington. D.C.; Mar. 30, 2006). 

® GAO, United States Coast Guard: Lnprovements Needed in Management and Oversight of 
Rescue System Acquisihon,GhOfi&^33. (Washington, D.C.; May 31, 2006). 
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as (1) the project was not a major investment; (2) agency 
management is experienced in overseeing projects; or (3) the 
project did not have weaknesses in its business case. In particular, 
one agency stated that their list does not include all high risk 
projects, only those that are the highest priority of the high risk 
investments. However, none of the reasons provided are associated 
with OMB’s high risk definition. Without consistent application of 
the criteria, 0MB and executives cannot have the assurance that all 
projects that require special attention have been identified. 


0MB Does Not Use an Aggregate List to Perform Its Oversight of the Management 
Watch List or High Risk Projects 


While OMB’s Management Watch List identified opportunities to 
strengthen investments and promote improvements in IT 
management, 0MB did not develop a single, aggregate list 
identifying the projects and their weaknesses. According to 0MB 
officials, they did not construct a single list of projects meeting their 
watch list criteria because they did not see such an activity as 
necessary in performing OMB’s predominant mission: to assist in 
overseeing the preparation of the federal budget and to supervise 
agency budget eidministration. Thus, 0MB did not exploit the 
opportunity to use the list as a tool for analyzing IT investments on a 
govermentwide basis, limiting its ability to identify and report on the 
full set of IT investments requiring corrective actions. 

In addition, while 0MB asked agencies to take corrective actions to 
address weaknesses associated with projects on the Management 
Watch List, it did not develop a structured, consistent process or 
criteria for deciding how to follow up on these actions. We also 
reported that because it did not consistently monitor the follow-up 
performed, OMB could not tell us which of the 621 projects 
identified on the fiscal year 2006 list received follow-up attention, 
and it did not know whether the specific project risks that it 
identified through its Management Watch List were being managed 
effectively. This approach could leave resources at risk of being 
committed to poorly planned and managed projects. Thus, OMB was 

GAO-06-1O99T 
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not using its Management Watch List as a tool for improving IT 
investments on a govemmentwide basis and focusing attention 
where it was most needed. 

Similar to the Management Watch List, we reported in Jime 2006 
that while OMB analysts review the quarterly performance reports 
on high risk projects, they did not compile a single aggregate list of 
high risk projects. According to OMB staff they did not see such an 
activity as necessary in achieving the intent of the guidance — to 
improve project planning and execution. Consistent with our 
Management Watch list observations and recommendations, we 
believe that by not having a single list, OMB is limiting its ability to 
identity and report on the full set of IT investments across the 
federal government that require special oversight and greater 
agency management attention. 


Implementation of Recommendations Can Lead to Improved 
Processes to Identify and Oversee Management Watch List and High 
Risk Projects 


To address our key findings, we made several recommendations to 
the Director of OMB. For exanrple, to improve how the 
Management Watch List projects are identified, we have made 
several recommendations to improve the accuracy and validity of 
exhibit 300s for mqjor IT investments, including that the Director 
require agencies to determine the extent to which the information 
contained in each exhibit 300 is accurate and reliable, and, where 
weaknesses in accuracy and reliability are identified, disclose them 
and explain the agency’s approach to mitigating them. We also 
recommended that the Director provide for training of agency 
personnel responsible for completing exhibit 300s, and specified 
that, in developing the training, OMB consult with agencies to 
identify deficiencies that the training should address. Likewise, to 
improve how high risk projects are identified, we recommended that 
the Director direct federal agency CIOs to ensure that they are 
consistently applying the high risk criteria defined by OMB. 
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To improve how the Management Watch List is provided oversight, 
in our April 2005 report, we recommended that the Director of 0MB 
develop a central list of projects and their deficiencies and report to 
Congress on progress made in addressing risks of m^or IT 
investments and management areas needing attention. In addition, 
to fully realize the potential benefits of using the Management 
Watch list, we recommended that OMB use the list as the basis for 
selecting projects for follow-up, tracking follow-up activities and 
analyze the prioritized list to develop governmentwide and agency 
assessments of the progress and risks of IT investments, identifying 
opportunities for continued improvement. We also made similar 
recommendations to the regarding high risk projects. Specifically, 
we recommended that OMB develop a single ^gregate list of high 
risk projects and their deficiencies and use that list to report to 
Congress progress made in correcting high risk problems, actions 
under way, and further actions that may be needed. 

OMB generally disagreed with our recommendations for 
strengthening the Management Watch List and high risk projects 
processes. Specifically, OMB’s Administrator of the Office of E- 
Government and Information Technology stated that the ultimate 
responsibility to improve the accuracy and reliability of the exhibit 
300s lies with the agencies. While this is true, OMB also has 
statutory responsibility for providing IT guidance govemmentwide, 
especially when it involves an OMB-required budget document 
Regarding the consistent application of the high risk criteria, the 
Administrator stated that some flexibility in the application of the 
criteria is essential. While some flexibility may be appropriate, we 
believe that these criteria should be more consistently applied so 
that projects that clearly meet them are identified and provided 
oversight. The Administrator also disagreed with our 
recommendations that an aggregated govemmentwide Management 
Watch List and high risk project list is necessary to perform 
adequate oversight. However, we continue to believe that these lists 
are needed to facilitate OMB’s ability to track progress. Addressing 
these recommendations would provide increased assurance that 
poorly planned and performing projects are accurately identified 
and more effectively provided oversight 
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In summary, tlie Management Watch List and High Risk processes 
play important roles in improving the management of federal IT 
investments by helping to identifying poorly planned and performing 
projects totaling at least $12 billion that require management 
attention. However, the number of projects identified on both lists is 
likely understated because the Management Watch List is derived 
from budgetary documents that are not always accurate and reliable 
and the high risk projects are not always identified consistently 
using 0MB criteria. In addition, we noted areas where oversight of 
both sets of projects could be strengthened primarily by reporting 
the results in the aggregate so that govemmentwide analyses can be 
performed, progress can be tracked, and Congress can be informed. 
The recommendations we made to agencies and 0MB to address 
these issues are aimed at providing greater assurance that poorly 
planned and performing projects are more accurately identified and 
receiving adequate oversight, and ultimately ensuring that 
potentially billions of taxpayers dollars are not wasted. 


Contacts and Acknowledgements 

If you should have any questions about this testimony, please 
contact me at (202) 512-9286 or by e-mail at pownerd@gao,gov. 
Other individuals who made key contributions to this testimony are 
Sabine Paul and Niti Tandon. 


Page 21 GAO-06-1099T 

DRAFT 


(310828) 


59 


i 

G A O 

Accountability • Integrity ♦ Reilabllity 

United States Government Accountability Office 
Washington, DC 20548 

November 17, 2006 

The Honorable Tom Cobum 
Chairman 

The Honorable Thomas R. Carper 
Ranking Minority Member 

Subcommittee on Federal Financial Management, Government Information, and 
International Security 

Committee on Homeland Security and Governmental Affairs 
United States Senate 

Subject: Management of Risky IT Projects 

This letter responds to your request that we answer questions related to our 
testimony on September 7, 2006.’ During that hearing, we summarized (1) the number 
of projects and the fiscal year 2007 dollar value of the Office of Management and 
Budget’s (0MB) Management Watch list and high risk projects, (2) previously 
reported results on how these projects are identified and provided oversight, and (3) 
our recommendations to improve these processes. Your questions, along with our 
responses, follow, 

1. What is your opinion on the OMB’s announcement that they reduced the number of 
projects on the Management Watch iist from 263-86? 

The announcement that the number of projects on the Management Watch List was 
reduced from 263 to 86 means that, according to 0MB, fewer poorly planned projects 
are being funded and therefore potentially fewer taxpayer dollars are at risk of being 
wasted. However, the 86 projects are still significant because, according to 0MB, they 
total $4.5 billion for the fiscal year 2007 President’s budget request. Therefore, it is 
essential that follow-up on the 86 projects occur and that 0MB improve its follow-up 
activities. We reported in 2005 that 0MB lacked a consistent and integrated approach 
to follow-up on and track progress in addressing weaknesses associated with the 
Management Watch List projects and that, because of this, there is an increased risk 
that remedial actions by agencies were incomplete.^ We made recommendations to 
0MB aimed at improving the consistency with which identified weaknesses are 
followed up on and tracked. 


'GAO, Information Technology: Improvements Needed to More Accurately Mentily and Better Oversee 
Bisky Projects Totaling Billions ofDoBars, GAO-06-1009T (Washington, D.C.: Sept 7, 2006). 

’ GAO, Information Technology: OMB Can Make More Effective Use of Its Investment Reviews, GAO- 
OB-276 (Washington, D.C.: April 16, 2005). 
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2. You listened to the OMB describe the resources that they have to review 
information technology projects. Do you believe that they have adequate resources to 
carry out their responsibility of overseeing ail federal IT investments? 

OMB should be commended for its efforts to identify federal IT investments needing 
more attention and to reduce the number of projects that are poorly planned or 
poorly performing. Although, we do not have specific information on the number of 
resources OMB has to support these efforts, OMB has in the past sought 
opportunities to engage other entities, including the Chief Information Officers (CIO) 
Council and agencies’ Inspector General offices, to oversee federal IT investments. 
For example, in its August 2005 memo® to Chief Information Officers, OMB required 
CIOs to assess, confirm, and document the performance of high risk projects and 
provide the performance documents to the agency Inspector General and the 
Government Accountability Office upon request for additional oversight. Given the 
size of the federal IT budget — the President’s budget request for fiscal year 2007 
comprises over 800 projects, totaling approximately $64 billion — we believe that 
OMB should continue to seek opportunities to rely on assistance from accountability 
offices to support the Congress in overseeing federal IT investments. 

3. In your opinion, should Chief Information Officers be responsible for filling out 
exhibit 300s? 

The Clinger-Cohen Act of 1996 assigned CIOs with responsibility for better linking IT 
planning and investment decisions to program missions and goals and to implement 
and enforce IT management policies, procedures, standards, and guidelines. Given 
this responsibility, CIOs should play a significant role in ensuring the accuracy and 
reliability of the exhibit 300s. “ The task of filling out these forms can be left up to 
project managers or other staff who are more directly involved in the day-to-day 
management of the projects. We recently reported that underlying support for the 
information provided in the exhibit 300s was often inadequate.' Accordingly, we 
recommended that OMB work through agency CIOs to improve the accuracy and 
reliability of exhibit 300s for major IT investments. 


In responding to these questions, we relied on previously reported information on 
initiatives for improving the management of federal IT investments.® We performed 


' OMB, Memorandum for Chief Information Officers: Improving Information Technology (IT) Project 
Planning and Execution, M-05-23 (Washington, D.C.; Aug. 4, 2005) 

* CIOs typically work with investment boards to carry out this responsibility. An investment board is a 
decision-making body, made up of senior program, financial, and information managers, that is 
responsible for making decisions about IT projects and systems, based on comparisons and trade-offs 
among competing projects, with an emphasis on meeting mission goals. 

' GAO-06-260. 

GAO-05-276; GAO. Information Technology: Agencies Need to Improve the Accuracy and Reliability 
of Investment Information, GAO-06-250 (Washington, D.C.: Jan. 12, 2006); GAO, Information 
Technology: Agencies and OMB Should Strengthen ITocesses for Identifying and Overseeing High Risk 
Projects, GAO-06-647 (Washington, D.C.; June 16, 2006) 
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our work in November 2006, in accordance with generally accepted government 
auditing standards. 

Should you or your office have any questions on matters discussed in this letter, 
please contact me at (202) 512-9286 or pownerd@gao.gov. 

Sincerely yours, 







David A, Powner 


Director, Information Technology 
Management Issues 
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